PowerPoint Zero-Day Exploit

 Published on 19 Jul 2006 ·  Filed in News ·  185 words (estimated 1 minutes to read)

The zero-day exploit takes advantage of a previous unknown vulnerability in PowerPoint to install a Trojan Horse application. The vulnerability affects PowerPoint 2000, 2002, and 2003 running on various flavors of Microsoft Windows; it is unclear at this time whether Macintosh versions of Office are affected. Based on what is known of exploit, it seems unlikely that Macs could be affected by the exploit, but that is not to say that the vulnerability doesn’t exist in the Mac versions of Office. (Keep in mind that a vulnerability isn’t the same as an exploit.)

More information is available at the following links:

• http://blogs.technet.com/msrc/archive/2006/07/14/441893.aspx

• http://www.microsoft.com/technet/security/advisory/922970.mspx

• http://www.securityfocus.com/bid/18957

• http://securityresponse.symantec.com/avcenter/venc/data/trojan.ppdropper.b.html

• http://secunia.com/advisories/21040/

• http://isc.sans.org/diary.php?storyid=1484

• http://securitytracker.com/alerts/2006/Jul/1016496.html

• http://blogs.securiteam.com/?p=508

• http://www.kb.cert.org/vuls/id/936945

Simple filtering for PowerPoint files at the perimeter based on file extension is insufficient; Windows will open files in PowerPoint if they have a correct PowerPoint file header but an incorrect extension. If your anti-virus vendor has released updates to check for infected/affected PowerPoint documents, be sure to install that update and vigorously check all incoming PowerPoint documents.

Now that Word, Excel, and PowerPoint have all had their zero-day exploits, which Office application is next?

Metadata and Navigation

 Macintosh  Microsoft  Office  Security
Previous Post: GPMC Scripts
Next Post: Monitoring Event Logs with Log Parser

Be social and share this post!