PowerPoint hit by new zero-day exploit

By Shaun Nichols on Oct 17, 2006 10:17 AM
Filed under Security

Microsoft warns flaw could allow remote code execution.

A new vulnerability in Office has emerged just two days after Microsoft's monthly patch release on 10 October.

The Microsoft Security Response Centre warned in a blog posting that a new vulnerability in PowerPoint could allow remote code execution.

The vulnerability has only been presented as proof-of-concept code meaning that, although a security flaw has been found, there is no evidence of any exploit code or active attacks taking place.

Microsoft issued four patches on Tuesday for vulnerabilities in Office that allowed for remote execution of code.

In one case, attackers were using specially crafted files to target another vulnerability in PowerPoint in order to gain access to a system and run malware.

The US Computer Emergency Readiness Team urges users to avoid opening attachments in unsolicited emails and to scan all attachments with an antivirus program before running the code.