PDA

View Full Version : PowerPoint 0day Exploit (9-27-06)

Caine
September 28th, 2006, 09:36 PM
http://www.nist.org/news.php?extend.173 -{ Quote: "McAfee is warning that a new 0day PowerPoint exploit has been seen in the wild. Currently being used in targeted attacks. Remote code execution possible. Microsoft may have quietly added protection for it to their own antivirus program without alerting the security community.

Hopefully the antivirus programs will have signatures for this soon so unless you are the "target" in the "targeted attacks" you should be ok. The only way to suffer the exploit is to launch the file. So if you receive a PowerPoint 'ppt' file you are not expecting you should not open it. Office 2000, Office XP, and Office 2003 are affected and reports are indicating that the Mac versions are also vulnerable" }-
Is this covered by NOD32?
pykko
September 29th, 2006, 04:10 AM
Yes, it is now Caine! ;)
See here (http://nod32sse.com/view.php?id=1598&highlight=W97M/TrojanDropper.Lafool.F)
Definition is highlighted: W97M/TrojanDropper.Lafool.F
pykko
September 29th, 2006, 08:24 AM
hmm...it seems they've added it actually today. :-\

I think this (http://nod32sse.com/view.php?id=1599&highlight=PP97M/TrojanDropper.PPDrop) are the right definitions: PP97M/TrojanDropper.PPDrop.F, PP97M/TrojanDropper.PPDrop.NAA (2), PP97M/TrojanDropper.PPDrop.NAB
Caine
September 29th, 2006, 12:57 PM
Nice one! Thanks for that pykko. :)

Is this sort of behaviour common with Microsoft? Pretty sneaky carry-on altogether. :gack:
pykko
September 30th, 2006, 03:13 PM
Well, generally there are many exploits on MS products because many use them and hackers try to exploit evry little bug from them. ;D
Caine
October 1st, 2006, 08:15 PM
True that, but still though it's not so much the volume of exploits that MS inevitably have to battle with. It's the way they fixed up their own Security software defs and said nothing to the others. That's the bit that bugs me. Aw well, worrying over nothing since it's not an issue now.
pykko
October 2nd, 2006, 07:32 AM
-{ Quote: "It's the way they fixed up their own Security software defs and said nothing to the others. " }-
Well, yes, basically if a new dangerous threat appear AV companies should be willing to exchange defs. ;)