Microsoft confirmed limited, targeted attacks exploiting an unpatched vulnerability in Microsoft Office PowerPoint. If successfully exploited, the PowerPoint bug could enable hackers to take control of the victim's computer.
Hackers are launching attacks against an unpatched vulnerability in
Microsoft Office PowerPoint, the company's popular presentation program.
Microsoft
described the attacks in an advisory as "limited and targeted" in scope,
but cautioned that a successful exploit could allow a hacker to execute
arbitrary code with the rights of the logged-on user.
"The vulnerability is caused when Microsoft Office PowerPoint accesses an
invalid object in memory when parsing a specially-crafted PowerPoint file,"
according to the advisory. "This creates a condition that allows the attacker
to execute arbitrary code."
According to Microsoft, the malicious PowerPoint files are detected by
the Windows Live OneCare safety scanner as
Exploit:Win32/Apptom.gen.
The products impacted by the bug are Microsoft Office PowerPoint 2000 Service
Pack 3, Microsoft Office PowerPoint 2002 Service Pack 3 and Microsoft Office
PowerPoint 2003 Service Pack 3. Microsoft Office PowerPoint 2007 is unaffected.
While users wait for a patch, Microsoft offered up a few pieces of advice.
The first is to avoid Office files received from either unknown sources or
unexpectedly from trusted sources. PC owners can also turn to Microsoft Office
Isolated Conversion Environment (MOICE) to open suspicious files, and utilize
Microsoft Office File Block policy to block the opening of Office 2003 and
earlier documents.
"Microsoft will take the appropriate action to protect our customers, which
may include providing a solution through our monthly security update release
process, or an out-of-cycle security update, depending on customer needs,"
blogged Bill Sisk, communications manager for the
Microsoft
Security Response Center.
Email
Print
