Vulnerability in Microsoft OLE could allow remote code execution.

[1PW]

References: 

CVE-2014-6352
 
Microsoft Security Advisory 3010060

Microsoft security advisory: Vulnerability in Microsoft OLE could allow remote code execution: October 21, 2014
 
Fix it: Apply the OLE packager shim workaround
 
Fix it: Remove the OLE packager shim workaround
 

http://www.csoonline.com/article/2837252/vulnerabilities/microsoft-warns-of-new-zero-day-attack.html
 
On Tuesday, Microsoft issued an advisory warning of a new Zero-Day vulnerability that impacts all supported versions of their Windows operating system except, Windows Server 2003. The software giant also confirmed targeted attacks looking to exploit this flaw.

The advisory says that attackers are using PowerPoint files, which contain a malicious Object Linking and Embedding (OLE) object, to trigger the vulnerability. OLE technology is used to share data between applications.

"The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file that contains an OLE object. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user,"

[David H. Lipman]

Thanx  1PW  !

[daledoc1]

Did the Fixit require a reboot?

[David H. Lipman]

Corporations live off of PowerPoint Presentation Slides.  They would be perfect Spear Phishing targets but not the home user.

[daledoc1]

I use PPT all the time for work.

 

So, has anyone done the Fixit?

If so, does it require a reboot, or not?

 

Thanks,

[1PW]

Did the Fix it require a reboot?

FWIW - in the case of my W7Prox64SP1 system, no it did not.

The Fix it that applies (51026) does generate a System Restore Point (SRP).

HTH

[daledoc1]

Thanks, @1PW.

I'll probably try it on my backup box first.

 

And I presume there will be a formal patch for this vulnerability eventually, perhaps with next month's Black Tuesday offerings.

(Alas, sometimes the user has to undo the Fixit before installing the formal patch. More work again next month. Sigh.)

[1PW]

Thanx  1PW  !

You're welcome sir.