We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
79,864 News Articles

PowerPoint flaw 'old news'

Microsoft says it was fixed last month

An unpatched security flaw in PowerPoint is not so new after all, according to Microsoft, which claims it fixed the problem earlier this month.

On Saturday, Trend Micro published a description of a Trojan called Troj_mdropper.bh which, it claimed, exploited an undocumented bug in PowerPoint. The description was based on code samples retrieved on 17 August, according to Trend Micro.

The initial report was published without consulting Microsoft, and initially Trend Micro said the flaws exploited were different from the PowerPoint bugs patched in advisory MS06-048 on 8 August. The flaw was widely reported, including on the US government's National Vulnerabilities Database.

Once Microsoft received samples of the code, it tested them and found that, in fact, MS06-048 did fix the problem, the company said late on Monday. Trend Micro has been forced to amend its initial report, which now states that "This malware exploits a known vulnerability in Windows," and recommends downloading the patch.

The Trojan does, however, still affect unpatched systems.

Once Troj_mdropper.bh arrives on a system, either downloaded from the internet or dropped off by other malware, it exploits the known PowerPoint bug, allowing it to execute arbitrary code on Windows, according to Trend Micro. It attempts to drop the Small-CMZ Trojan into the temporary folder of the machine, and Small-CMZ, in turn, attempts to download various other malware from the internet.


IDG UK Sites

Swatch to release its own line of smartwatches to rival iWatch

IDG UK Sites

From the iPhone 6 to the iWatch and a new Apple TV we look at the products Apple is set to launch...

IDG UK Sites

Miranda July's Somebody app offers a very unusual take on messaging

IDG UK Sites

The 7 most ridiculous iPhone 6 rumours: what Apple WON'T reveal on 9 September