Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

Guest Blog // Selected Security Content Provided By Sophos
What's This?
4/3/2009
12:33 PM
Graham Cluley
Graham Cluley
Security Insights
50%
50%

IT Staff Wait For Critical Zero-Day PowerPoint Fix

You may have experienced the soul-destroying feeling of sitting through a far-too-long corporate presentation, but a new critical flaw could deliver a far more serious case of "Death by PowerPoint."

You may have experienced the soul-destroying feeling of sitting through a far-too-long corporate presentation, but a new critical flaw could deliver a far more serious case of "Death by PowerPoint."Yes, IT system administrators are being warned today about a critical security vulnerability in select versions of Microsoft PowerPoint, which is being used by hackers to install malicious code without user intervention.

Microsoft has confirmed that a critical vulnerability exists in some versions of Microsoft Office PowerPoint, which is allowing malicious attackers to run unauthorized code on users' computers.

Microsoft Office PowerPoint 2000 Service Pack 3, Microsoft Office PowerPoint 2002 Service Pack 3, Microsoft Office PowerPoint 2003 Service Pack 3, and Microsoft Office 2004 for Mac are all affected. Meantime, users of current versions -- Microsoft Office PowerPoint 2007 and Microsoft Office for Mac 2008 -- can breath easy.

Of course, PowerPoint is commonly used in the business environment for delivering corporate presentations, and hackers are attempting to trick workers into opening malicious PPT attachments that could exploit the flaw and install malware onto computers.

Sophos has seen a number of samples of malware exploiting the vulnerability, and will shortly be releasing protection against them as Troj/ExpPPT-A. You can read more about our assessment of the vulnerability in our analysis.

So the big question is...when will Microsoft get its patch out? Its next scheduled megapatch is due on Tuesday, April 14, but it's unclear whether they will be able to create and properly test a fix in time for distribution.

In the meantime, cybercriminals have a window of opportunity to infect computers. Be warned: They've shown themselves not to be slow coaches when it comes to taking advantage of a weakness like this.

So take action now. Make sure your antivirus software is configured to automatically update as security vendors rush out detection routines, and ensure your staff knows not to open unsolicited or unknown PowerPoint files -- just in case they are carrying a dangerous payload.

Graham Cluley is senior technology consultant at Sophos, and has been working in the computer security field since the early 1990s. When he's not updating his other blog on the Sophos website you can find him on Twitter at @gcluley. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Windows 10 Migration: Getting It Right
Kevin Alexandra, Principal Solutions Engineer at BeyondTrust,  5/15/2019
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/14/2019
When Older Windows Systems Won't Die
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12184
PUBLISHED: 2019-05-19
There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart, sequence, gallery, or chart, as demonstrated by a crafted SRC attribute of an IFRAME element, a different vulnerability than CVE-2019-12136.
CVE-2019-12173
PUBLISHED: 2019-05-18
MacDown 0.7.1 (870) allows remote code execution via a file:\\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138.
CVE-2019-12172
PUBLISHED: 2019-05-17
Typora 0.9.9.21.1 (1913) allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137.
CVE-2019-12168
PUBLISHED: 2019-05-17
Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.
CVE-2019-12170
PUBLISHED: 2019-05-17
ATutor through 2.2.4 is vulnerable to arbitrary file uploads via the mods/_core/backups/upload.php (aka backup) component. This may result in remote command execution. An attacker can use the instructor account to fully compromise the system using a crafted backup ZIP archive. This will allow for PH...