Attacks still battering unpatched Windows flaws

Microsoft issued a rare, out-of-cycle Windows patch on Tuesday that fixed one flaw but attacks through other known, yet-to-be-plugged holes continue.

Microsoft on Wednesday warned of "limited zero-day attacks" that exploit a new flaw in PowerPoint. For the attack to be carried out, a user must first open a malicious PowerPoint file attached to an email or otherwise provided to them by an attacker, Microsoft said in a security advisory.

Symantec said in an alert sent to customers: "This issue can allow remote attackers to execute arbitrary code on a vulnerable computer." The flaw affects PowerPoint in Office 2000, Office XP and Office 2003 on Windows and Apple's Mac OS X, it said. Attacks appear to be aimed at specific targets, Symantec said.

For temporary protection against PowerPoint attacks, Microsoft suggests keeping security software up-to-date and not opening presentations files from untrusted sources. Also, PowerPoint Viewer 2003 is not vulnerable, the company said.

The PowerPoint flaw is one of several security holes cyber crooks are actively exploiting but for which no patch exists, security experts said. A flaw in Word has gone unpatched since early this month and a flaw in an IE ActiveX control called daxctle.ocx first surfaced on 14 September.

Ken Dunham, director of the rapid response team at VeriSign's iDefense, said: "There is more than one thing going on right now in terms of zero-days. The timing of these attacks and exploits is designed to be a thorn in the side of Microsoft." Some security watchers have started to coin the term "zero-day Wednesday".

Microsoft issued a "critical" security fix for Windows on Tuesday, two weeks before its scheduled release date. The update repairs a flaw in a Windows component called 'vgx.dll'. This component is meant to support Vector Markup Language (VML) documents in the OS.

Miscreants had been using the VML flaw to load malicious software onto vulnerable PCs unbeknown to the user. The hole could be exploited by crafting a malicious file and providing a link to it on a website or in an email message. At one point several million domains were redirecting to malicious VML sites, according to iDefense.

A McAfee spokeswoman said in a statement: "This comes at a particularly challenging time for Microsoft. It is currently trying to convince consumers and businesses that it's a credible provider of security software. It's like closing the stable door after the horse already bolted. Too little too late."

Joris Evers writes for CNET News.com