Zero-day attacks continue to hit Microsoft

Microsoft issued a rare, out-of-cycle Windows patch on Tuesday that fixed one flaw, but attacks through other known, yet-to-be-plugged holes continue.

Microsoft on Wednesday warned of "limited zero-day attacks" that exploit a new flaw in PowerPoint, Microsoft's widely used presentation tool. For the attack to be carried out, a user must first open a malicious PowerPoint file attached to an e-mail or otherwise provided to them by an attacker, Microsoft said in a security advisory.

"This issue can allow remote attackers to execute arbitrary code on a vulnerable computer," Symantec said in an alert sent to customers. The flaw affects PowerPoint in Office 2000, Office XP and Office 2003 on Windows and Apple Computer's Mac OS X, it said. Attacks appear to be aimed at specific targets, Symantec said.

For temporary protection against PowerPoint attacks, Microsoft suggests keeping security software up-to-date and not opening presentations files from untrusted sources. Also, PowerPoint Viewer 2003 is not vulnerable, the company said.

The PowerPoint flaw is one of several security holes cybercrooks are actively exploiting, but for which no patch exists, security experts said. A flaw in Word has gone unpatched since early this month and a flaw in an IE ActiveX control called daxctle.ocx first surfaced on Sept. 14.

"There is more than one thing going on right now in terms of zero-days," said Ken Dunham, director of the rapid response team at VeriSign's iDefense. "The timing of these attacks and exploits is designed to be a thorn in the side of Microsoft." Some security watchers have started to coin the term "zero-day Wednesday."

Microsoft issued a "critical" security fix for Windows on Tuesday, two weeks before its scheduled release date. The update repairs a flaw in a Windows component called "vgx.dll." This component is meant to support Vector Markup Language documents in the operating system.

Miscreants had been using the VML flaw to load malicious software onto vulnerable PCs unbeknownst to the user. The hole could be exploited by crafting a malicious file and providing a link to it on a Web site or in an e-mail message. At one point several million domains were redirecting to malicious VML sites, according to iDefense.

"This comes at a particularly challenging time for Microsoft," Siobhan MacDermott, a McAfee spokeswoman, said in a statement. "It is currently trying to convince consumers and businesses that it's a credible provider of security software. It's like closing the stable door after the horse already bolted. Too little too late."

[Microsoft_Facts]

There will forever be serious vulnerabilities in MS products

Nothing has changed in 10+ years, there are more serious vulernabilities each year in MS products than all other IT products known to mankind combined.

[Gunady]

Which software product will stop to have serious vulnerabilities?

Tell me..
Most popular software product will attract people try to hack into. If there is no or little flaw found, it means the product is less popular. Firefox, I like it and it's (very) popular, but serious vulnerabilities are found more and more, even more than IE based on Symantec latest report. This is software technology problem and it's getting more mature, but not yet. If you are main player in this technology, you will understand what I mean. IMO, the matter is how fast the vendor fix the problem. I praise mozilla for fixing very fast. But microsoft is also not bad in responding to the flaw finding, especially determine his customer size. What do you think?

[richto]

Actually thats not the case

Actually there are at least 3 times as many vulnerabilities in Linux each year as there are in Microsoft products...And Linux vendors take on average twice as long to fix them as Microsoft.

[aabcdefghij987654321]

Wrong, just plain wrong

You must not have ever subcribed to a bug reporting service or you'd know that your statement about how many MS bugs there are vs the rest of the world is simply and totally incorrect.

[iRhapsody]

MS- The Core Target

As long as MS retains the dominant position in the PCs, hackers as well as MS haters will continuously seek after the vulnerabilities in MS products.

[DeusExMachina]

market share has nothing to do with viruses

It is a pure myth that malware is associated in any way with
market share. I know it makes people think they are intellectual
to continue to make these comments, but it just comes off as
ignorance. First, the primary motivation behind those who WRITE
malware, as opposed to those who deploy it, has never been
financial, until VERY recently. Instead, it is bragging rights in the
black hat community. As such, no one is particularly impressed
anymore by someone discovering and exploiting a new hole in
MS products,. It is like stealing lollipops from children.
More to the point, counter examples prove the fallacy. OS9, with
a significantly smaller footprint, was replete with viruses. (Not as
many as Windows, but that was because, even, then, the mac
was a more secure platform.) OSX, with a much greater user
base, has 0. Zero, zilch, nada, nil.
This makes it a HUGE target to MANY virus writers. Many people
have tried, and still, not a SINGLE account of a malware event in
the wild has EVER been substantiated.
Linux and other flavours of UNIX should have an order of
magnitude more.
What ever you feel about the merits of either OS, the logic of
dominant position parroted here necessitates that OS9 should
have few viruses, and OSX, significantly more, and UNIX should
be awash in them. Yet this is not the case, and this alone
disproves the assertion.
This has been common knowledge for some time, yet still it
impossible to kill this stupid meme,
I know you THINK it makes sense, but common sense is just
that, common. If common sense were always right, there would
be no premium on intellect. Just because it makes sense to you,
does not make it true. As the late great Richard Feynmann said,
if your theory does no match the data, it is wrong. Period.

[imacpwr]

Surf safe, AVOID Microsoft software..!!

Ok, so this one will affect Apple computers as well (with Office) but
it's still wise to AVOID USING Microsoft software if you want to be
safe on the Internet..!!!

[DeusExMachina]

Surf's up!!!

Actually, it is doubtful that it will affect macs. While the flaw exists
in OfficeMac, the ability to craft it into an exploit is not the same.
All it will likely do is crash Powerpoint, which is kinda karma, IMHO.
OSX has a number of mechanism by which this would be thwarted.
It is only because MS insists on a default execute model for their
OS (because they are greedy and want to monetize data and leave
open channels for revenue streams in everything) that they are so
vulnerable to this type of flaw. Surf on, mac users!

[thedreaming]

The price of a safe system..

Is constant updates. It doesn't matter what OS you call home, you have to keep it updated. All OS get security updates and when they come in, I apply them.

I must admit, however, that with Microsoft being target #1, I've been doing more and more surfing using my linux partition. I've also been doing multiple backups and more often.

Remember the good old days when no one had to use a firewall or antivirus programs and no one had a clue what spyware was? I miss those days!

[wbenton]

Zero-Day Patch Required

There are no two ways around it.

24 hours for Critical patches... 72 hours for non-critical patches.

It's the ONLY way... even though Microsoft continues to think there still a Microsoft way!!! (* LOL *)

Walt

[ramprage]

No patch required with Firefox

Well Firefox users weren't affected by this "critical exploit" read more at www.ienomore.com