Microsoft Word 2010 0-day vulnerability being actively exploited

This goes hand in hand with my earlier post, 2014-03-25 Phishing Scam Alert, which included a text file (.txt) attachment.  Attackers can easily hide the correct file extension to make things appear to be a different file type.

By default Microsoft turns on "Hide extensions for known file types".  If this is enabled the true file extension is not displayed.  In other words, "Malicious File Attachment.txt.rtf" will be displayed to the user as "Malicious File Attachment.txt".  However when the file will open in Word because it is a Rich Text Format (.rtf) file.

Now for the alert which is being actively exploited in the wild:

Microsoft Releases Security Advisory