Microsoft to patch critical PowerPoint zero day flaw
Microsoft plans to issue one critical patch during its monthly patch cycle next week, plugging a critical flaw in its PowerPoint presentation program that is being actively targeted by attackers. The PowerPoint vulnerability was the only bulletin identified in the Security Bulletin Advance Notification issued today by Microsoft.
Details of the flaw surfaced last month and Microsoft acknowledged that the flaw was being exploited by hackers in the wild in targeted, limited attacks. PowerPoint versions affected by the flaw are Office PowerPoint 2000 Service Pack 3, Office PowerPoint 2002 Service Pack 3, and Office PowerPoint 2003 Service Pack 3.
In a Microsoft Security Advisory issued April 2, the software giant said the flaw could allow remote code execution if a user is tricked into opening a malicious PowerPoint file. The malicious PowerPoint files identified by some security vendors, contain a Trojan dropper embedded within the presentation. The file can be passed via an email message with a malicious PowerPoint attachment or by tricking users to view a malicious website containing a Trojan downloader.
