Microsoft is investigating a report of a new, yet-to-be-fixed security vulnerability in PowerPoint, the company said late last week.
Sample attack code that exploits the vulnerability has already been released on the Internet, a Microsoft representative wrote on a corporate blog. Use of the code in an attack could cause a complete system compromise, according to Microsoft.
"The reported proof of concept may allow an attacker to execute code on a user's machine by convincing them to open a specially-crafted PowerPoint file," wrote Alexandra Huft, a Microsoft Security Response representative. "We are not aware of any attacks attempting to use the reported vulnerability."
The flaw affects PowerPoint 2003, according to Microsoft. Security monitoring companies Secunia and the French Security Incident Response Team, or FrSIRT, also list earlier versions as vulnerable. Secunia deems the issue "highly critical", while FrSIRT rates it "critical".
"The vulnerability is caused (by) an unspecified error when processing PowerPoint presentations," Secunia wrote in an advisory. For protection, people should not open Office documents received from untrusted sources, FrSIRT advices.
Word of the new PowerPoint flaw came only days after Microsoft last week released a slew of patches for Windows and Office. Several of the Office fixes were for flaws that also had previously been disclosed and some had been used in targeted cyberattacks.
Miscreants are taunting Microsoft with zero-day code, or attack code released immediately after a flaw or patch is made public, experts have said. Some security watchers have started to coin the term "zero-day Wednesday" to come after "Patch Tuesday", Microsoft's patch day on the second Tuesday of each month.
Play video
There are currently no comments for this post.