Microsoft has warned Windows users that cyber criminals are exploiting a zero-day vulnerability using malicious PowerPoint documents sent as email attachments.
In an advisory, Microsoft outlined the bug and provided a one-click tool from its “Fixit” line that customers can use to protect their PCs until a patch is available.
Although Microsoft does not label its advisories with the same four-step threat scoring system it uses for security updates, it said that a successful exploit would let hackers hijack the PC so that they could, for example, steal information or plant other malware on the machine.
The vulnerability affects all versions of Windows, from the aged Windows Server 2003 to the very newest Windows 8.1, and is within the operating system’s code that handles object linking and embedding (OLE) objects. OLE is most commonly used by Microsoft Office for embedding data from an Excel spreadsheet in, say, a Word document.
“At this time, we are aware of limited, targeted attacks that attempt to exploit the vulnerability through Microsoft PowerPoint,” the advisory said. Other Office file types, however, could also be used to exploit the flaw.
Ironically, Microsoft patched a similar vulnerability recently when it issued eight updates, including one that addressed a bug in OLE which, like this most recent revelation, had been exploited in the wild before a patch was pushed to customers.
That update was designated MS14-060 by Microsoft, and was also being exploited using malformed PowerPoint files.
According to researchers at iSight Partners, the flaw fixed by MS14-060 had been used by a Russian hacker crew to target Ukrainian government agencies, NATO, Western European government agencies and companies in the telecommunications and energy sectors, since at least December 2013. iSight slapped the moniker “Sandworm” on the cyberspy gang.
While iSight got the credit for finding the OLE vulnerability Microsoft patched last week, a trio of Google security engineers and a pair from McAfee Security reported the latest bug.
Microsoft did not explicitly promise to patch the zero-day, but it certainly will. The only question is when. Its next regularly-scheduled Patch Tuesday is 11 November. Historically, Microsoft has been hesitant to issue an emergency security update unless attack have spread widely and affected large numbers of customers.
In the meantime, Microsoft has crafted a Fixit tool that, if applied, blocks the attacks seen so far. The tool is located on this support page.
Microsoft also urged Windows users to pay attention to the User Account Control (UAC) pop-ups, the small alerts that require authorization before the OS is allowed to perform certain chores, like downloading files or running software.
UAC, which many Windows users see as an inconvenience — and many habitually click through without a second thought — will detect the malformed PowerPoint file and not run its hidden malware without permission.
“In observed attacks, User Account Control (UAC) displays a consent prompt or an elevation prompt, depending on the privileges of the current user, before a file containing the exploit is executed,” Microsoft’s advisory said.
Gregg Keizer, IDG News Service
Ltd
