AOH :: ISN-3066.HTM

Zero-day attacks continue to hit Microsoft

Zero-day attacks continue to hit Microsoft
Zero-day attacks continue to hit Microsoft 

By Joris Evers
Staff Writer, CNET
September 27, 2006

Microsoft issued a rare, out-of-cycle Windows patch on Tuesday that 
fixed one flaw, but attacks through other known, yet-to-be-plugged holes 

Microsoft on Wednesday warned of "limited zero-day attacks" that exploit 
a new flaw in PowerPoint, Microsoft's widely used presentation tool. For 
the attack to be carried out, a user must first open a malicious 
PowerPoint file attached to an e-mail or otherwise provided to them by 
an attacker, Microsoft said in a security advisory.

"This issue can allow remote attackers to execute arbitrary code on a 
vulnerable computer," Symantec said in an alert sent to customers. The 
flaw affects PowerPoint in Office 2000, Office XP and Office 2003 on 
Windows and Apple Computer's Mac OS X, it said. Attacks appear to be 
aimed at specific targets, Symantec said.

For temporary protection against PowerPoint attacks, Microsoft suggests 
keeping security software up-to-date and not opening presentations files 
from untrusted sources. Also, PowerPoint Viewer 2003 is not vulnerable, 
the company said.

The PowerPoint flaw is one of several security holes cybercrooks are 
actively exploiting, but for which no patch exists, security experts 
said. A flaw in Word has gone unpatched since early this month and a 
flaw in an IE ActiveX control called daxctle.ocx first surfaced on Sept. 

"There is more than one thing going on right now in terms of zero-days," 
said Ken Dunham, director of the rapid response team at VeriSign's 
iDefense. "The timing of these attacks and exploits is designed to be a 
thorn in the side of Microsoft." Some security watchers have started to 
coin the term "zero-day Wednesday."

Microsoft issued a "critical" security fix for Windows on Tuesday, two 
weeks before its scheduled release date. The update repairs a flaw in a 
Windows component called "vgx.dll." This component is meant to support 
Vector Markup Language documents in the operating system.

Miscreants had been using the VML flaw to load malicious software onto 
vulnerable PCs unbeknownst to the user. The hole could be exploited by 
crafting a malicious file and providing a link to it on a Web site or in 
an e-mail message. At one point several million domains were redirecting 
to malicious VML sites, according to iDefense.

"This comes at a particularly challenging time for Microsoft," Siobhan 
MacDermott, a McAfee spokeswoman, said in a statement. "It is currently 
trying to convince consumers and businesses that it's a credible 
provider of security software. It's like closing the stable door after 
the horse already bolted. Too little too late."

Visit the InfoSec News store! 

Site design & layout copyright © 1986-2015 CodeGods