Two days after Microsoft released 10 patches to remedy 26 vulnerabilities, the software giant's security team reported late Thursday that it is tracking a new zero-day exploit targeting PowerPoint.
Microsoft was alerted that hackers have publicly published proof-of-concept code that takes advantage of a bug in Office's PowerPoint 2003, said Alexandra Huft on the Microsoft Security Response Center blog. If an unsuspecting end user opens a specially crafted PowerPoint file, an attacker may be able to compromise a user's machine by executing arbitrary code.
Vulnerability monitoring firm Secunia today rated the flaw "highly critical" because it is unpatched and remotely exploitable.
"We are not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time," Huft said, adding that Microsoft continues to investigate.
Hackers publishing exploit code soon after Patch Tuesday has become a familiar scenario in recent months as attackers escalate their efforts on Redmond's popular client-side applications. Four of the 10 fixes released on Tuesday were designed to correct flaws in Office programs.
"I guess the game is still going on," Johannes Ullrich, chief research officer of the SANS Institute, said today on the agency's Internet Storm Center website. "We have seen it many times over the last few months where a new exploit was published just after Patch Tuesday."
Click here to email Dan Kaplan.
