"microsoft Update Closes Fourteen Vulnerabilities In Powerpoint

[Peaches]

12 May 2009, 19:58

"Microsoft update closes fourteen vulnerabilities in PowerPoint

Although, as announced, Microsoft is distributing only a single update (MS09-017) today, Patch Tuesday, it's a biggie that closes fourteen security vulnerabilities in PowerPoint 2000, 2002, 2003 and 2007, and in PowerPoint Viewer 2003 and 2007.

Microsoft describes at least twelve of the fourteen vulnerabilities as critical in PowerPoint 2000, because they allow code to be injected and run on a system. That's true in principle of the other PowerPoint versions too, but Microsoft considers their vulnerabilities to be one stage less critical, because later versions are designed to prevent the opening and saving of certain documents by default.

The vulnerabilities now closed include one that's been known for about five weeks and has already been exploited in targeted attacks. Microsoft expects that most of the other vulnerabilities will also be targeted by an exploit soon.

The Security Bulletin says Office for Mac 2004 and 2008 are also affected but updates for these won't be issued until later. In the Microsoft Security Research & Defense blog, Jonathan Ness writes that, because of the threat to Windows users, a decision was made to go early with the Windows packages rather than delay any longer. He adds that intensive work is now going on to test the Mac updates.

Besides this, Microsoft has updated its Malicious Software Removal Tool, but the Microsoft Malware Protection Center can't provide any information yet on what signatures have been added. Most recently, at the request of Facebook, Microsoft was building signatures to recognize the Koobface worm."

See also:

Microsoft Security Bulletin Summary for April 2009

Heise security - http://tinyurl.com/qtfwtd