Security threats Toolkit

Zero-day PowerPoint flaw gives rise to attacks

Tom Espiner ZDNet.co.uk

Published: 03 Apr 2009 12:54 BST

Hackers have launched attacks targeting an unpatched flaw in Microsoft PowerPoint, Microsoft warned on Thursday.

The vulnerability, which affects Microsoft Office 2000 SP3, 2002 SP3 and 2003 SP3, can be exploited by getting a user to open a PowerPoint file rigged for the attack. When the file is opened, PowerPoint will access an invalid object in memory. That then allows an attacker to remotely execute code on the system.

In a security advisory, Microsoft said that at present, attacks are not widespread, but they are tailored to affect specific victims.

"Microsoft is investigating new reports of a vulnerability in Microsoft Office PowerPoint that could allow remote code execution if a user opens a specially crafted PowerPoint file," said the advisory. "At this time, we are aware only of limited and targeted attacks that attempt to use this vulnerability."

While there is currently no fix for the PowerPoint flaw, Microsoft said that it may release one outside its monthly patching schedule. Workarounds suggested by the company include users not opening files received from untrusted sources, using the Microsoft Office Isolated Conversion Environment (MOICE) to open untrusted files, and using Microsoft Office File Block policy to restrict the opening of Office 2003 and earlier documents.

Microsoft's last major PowerPoint patch, which came out in August 2008, addressed three critical flaws in the software.