|
|
Security Watch: Microsoft Comes Up One Patch ShortDATE: 17-JUL-2006 Hot on the heels of Microsoft's Patch Day, hackers exploited a new, unpatched vulnerability in Microsoft's PowerPoint program.According to several sources, including Symantec's DeepSight Threat Analyst team, the vulnerability is being exploited in the wild through a malicious PowerPoint file. It's not clear if the attack is targeted and narrow or if it has spread further, but Microsoft says that the attacks are "very targeted."The precise details of the attack have not been publicly revealed yet, but it appears to target a shared Microsoft Office component, mso.dll. This is a remove code execution vulnerability, so the attacker can run software of his own choosing in the security context of the PowerPoint user.Symantec anti-virus products detect the attack as Trojan.PPDropper.B. It arrives as an attachment to an e-mail from a Google GMail account. The subject line contains Chinese characters. When executed the file runs a backdoor program detected as Backdoor.Bifrose.E which is written to the system as %System%\regvrt.exe.The backdoor program injects a malicious process into EXPLORER.EXE. This process overwrites the attack PDF file with a clean one in an attempt to impede its detection.
|
|
|
Data Protection Virtual Tradeshow
Available On-Demand
Join Cameron Crotty and experts as they explore best practices and solutions needed to maintain a secure flow of data.
|
|
|
