News

Lone Microsoft Patch Fixes PowerPoint Vulnerability

Critical bulletin addresses 14 remote-code-execution problems

• By Jabulani Leffall
• 05/12/2009

As expected, Microsoft rolled out only one patch for this month's Patch Tuesday, a critical bulletin for PowerPoint.

The solo release is said to fix as many as 14 reported remote code execution (RCE) vulnerabilities in the popular graphics and office presentation application.

Eric Schultze, chief technology officer for Shavlik Technologies, said Tuesday's hotfix is considered a client-side update because the RCE attack it addresses can deploy only when a user has opened a corrupt file.

"Typical client-side actions might include opening malicious documents, reading an evil e-mail or viewing an evil Web page. These types of attacks are usually constrained to systems where a user is interactively working on the desktop," Schultze said. "Systems which don't have a lot of user interaction at the desktop, like servers, are usually less susceptible to client-side attacks, though they are just as vulnerable if a user performs one of these actions at the desktop. In most cases, client-side exploits only obtain the same level of access on the system as that of the currently logged-on user."

May's patch, which may require a restart, covers a wide swath of Microsoft Office versions, such as Office 2000 and Office 2003, as well as Office XP and 2007 Microsoft Office Systems. However, there are also key programs the patch does not cover, among them PowerPoint Viewer 2003 and 2007; all supported versions of Microsoft Office Compatibility Pack for Word, Excel and PowerPoint 2007; and Microsoft Works 8.5 and 9.0. Microsoft rated all these programs "important" but will not fix them this month.

Mac users will also have to wait as Microsoft said PowerPoint on Mac won't be covered in this month's patch, either. The Mac programs in question -- all of which are labeled "important" -- are Microsoft Office for Mac (2004 and 2008 versions) and Open XML File Format Converter for Mac. Microsoft said it did not include a Mac fix because it has not seen exploits being executed against Macs, and the company didn't want to delay the rollout given that there were zero-day vulnerabilities already in play for Windows machines.

This month's Patch Tuesday is now the second in a row that Microsoft has fixed zero-day RCE exploits in a relatively expedient manner. For instance, this month's fix comes less than a month after a zero-day PowerPoint RCE vulnerability came to light, and for which the company issued a security advisory.

"For the last two months, users have been battling Microsoft Office zero-day attacks. The first set in February was in Microsoft Excel. The second set, announced on April 2, made users afraid of opening PowerPoint files," said Andrew Storms, director of security for nCircle. "Forty days from bug to bug [for a] fix is a decent turnaround for Microsoft given the vast number of Microsoft Office permutations that need to be quality-tested."

Though this month's Microsoft patch rollout is a light one, security experts say the various third-party security updates released in the last few weeks and slated for release this month need to be a priority.

"IT administrators shouldn't get the wrong impression and breathe easy given the light load. What is important for IT admins to understand is that May's Patch Tuesday isn't just about patching Microsoft's single patch, but rather fixing other security flaws that are non-MS-related in order to stay current and patched," said Paul Henry, security and forensic analyst for Lumension.

For those interested in non-security updates, Microsoft suggests users check out Windows Update, Microsoft Update and Windows Server Updates in this Knowledge Base link.