Attackers Target New PowerPoint Bug

One day after patching a widely exploited flaw in its Internet Explorer browser, Microsoft has a new bug to worry about, this time in PowerPoint.

Attackers have been exploiting a newly discovered bug in Microsoft's Office presentation software in extremely targeted attacks, McAfee reported Wednesday.

Researchers were made aware of the attacks when a customer submitted two different malicious PowerPoint files, both of which exploited the same vulnerability, said Craig Schmugar, a virus researcher at McAfee. Both files installed malicious remote-access Trojan horse software that then attempted to connect to an outside Web server, he said.

Affects at Least Three Versions of Office

Though McAfee is not releasing technical details of the exploit, the security vendor says that it has confirmed that the attack works on three versions of Office running on the Windows 2000 operating system: Office 2000, Office XP, and Office 2003. Other platforms and other Office applications may also be affected, but McAfee has not yet had time to complete its testing, Schmugar said.

Schmugar discussed the problem in a McAfee blog.

Microsoft "has concluded that this issue affects users of Microsoft Office 2000, Microsoft Office 2003, and Microsoft Office XP," the company said in a statement.

Microsoft and other security vendors, including Symantec and McAfee, have added signatures to their security products so that they can detect this malicious code.

Office Attacks

Over the past few months, attackers have focused on Office, exploiting a number of undisclosed Office bugs in extremely targeted attacks, often on government agencies or contractors. These attacks usually take the form of an e-mail that has a malicious Office document attached and is sent to a small number of victims.

This latest PowerPoint attack fits that pattern and was sent to a defense contractor, Schmugar said. He declined to provide further details about the intended victim.

Because the attack has been extremely limited in scope, it is considered to be a low risk for most users, Schmugar said.

News of the attack comes the day after Microsoft issued an emergency patch for a widely exploited bug that affected the VML (Vector Markup Language) rendering engine used by Internet Explorer and Outlook. Hackers are exploiting this critical flaw in the browser via mass e-mail and on thousands of Web sites, security experts said.

Microsoft's next set of security patches will be released October 10. The software vendor did not say whether it plans to patch this latest PowerPoint flaw.