Microsoft Spots New Vulnerability in Microsoft Office – Your PC may be at Risk

Share This Post

Heads up! In what feels like a throwback to the late 90s/early 2000’s, Microsoft has discovered one helluva bug in Microsoft Office. Executed properly, the bug could be exploited to take over your entire system running just about any version of Windows.

You can find Microsoft’s full disclosure on the bug here, but here’s the bulk of what you should know:

  • This bug is being exploited in the wild, though Microsoft only knows of “limited, targeted attacks” so far
  • It affects Windows Vista, Windows Server 2008, Windows 7, Windows 8, Windows Server 2012, and Windows RT. XP isn’t mentioned as Microsoft no longer supports it — but yeah, it’s probably affected too.
  • If executed properly, the exploit gives the attacker the same permissions on your system as whatever type of user you’re currently logged in as. If you’re an admin, that means full admin rights — code execution, app installs, etc.
  • If you have Window’s User Account Control feature enabled, it’ll throw up a prompt asking if the file is okay to execute. If you aren’t 100% sure that the file is legit, avoid doing so.
  • The bug is part of PowerPoint’s OLE system, which lets you embed things like spreadsheets into a presentation. It’s supposed to be fairly well sandboxed; alas, it looks like someone found a gap.
  • Microsoft says that hacked presentations e-mailed to users and hacked presentations sitting on the web are potentially dangerous. The short version: avoid all but the most-trusted PowerPoint presentations right now.

So just how gnarly is this bug? Says Microsoft (emphasis ours):

An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

But should you panic?

Nah. Do a few things things, and you should be safe:
1) Play it smart about what presentations you open
2) If you’re on a build of Windows that has User Account Control as an option, enable it (it should be on by default, in most cases.) This won’t fix the bug outright, but it’ll throw up a big permissions prompt that’ll remind you not to open mystery files.
3) Check out this advisory page from Microsoft, which offers up a temporary patch until Microsoft finalizes a security update.

Related Posts

Wi-Fi ‘virus’ could be used to attack wireless access points

Dense concentrations of Wi-Fi access points and routers in...

My [condensed] experience with Windows 10 so far…

On November 11th, 2015, "TH 2" was released for...

Use 2go, BBM & Whatsapp on your Windows PC or Mac

Although future generations of PCs are likely to be...

Windows 10’s Top 30 Tricks, Tips, and Tweaks in Pictures

Windows 10 comes with a lot of amazing features but not all of them are readily available. Let's dig a little deeper and unveil new tweaks, tricks and features that will change the way you use your PC.

GoDaddy Partners with Microsoft to offer Office 365 to small businesses

Microsoft  has partnered with a domain name and hosting company GoDaddy to...

Microsoft And Dell Sign Patent Royalty Agreement For Google’s OS

Today Dell and Microsoft announced that they have signed...
- Advertisement -