Intrusion Prevention

MS.PowerPoint.Converter.Remote.Code.Execution

Description

This indicates an attack attempt against a buffer-overflow vulnerability in the PowerPoint 4.0 converter which ships with PowerPoint 2000 through PowerPoint 2003.
The vulnerability is caused by a boundary error when the vulnerable software handles a specially crafted PowerPoint file. It may allow a remote attacker to execute arbitrary code.

Affected Products

Microsoft PowerPoint 2003 SP3
Microsoft PowerPoint 2003 SP2
Microsoft PowerPoint 2003 SP1
Microsoft PowerPoint 2003
Microsoft PowerPoint 2002 SP3
Microsoft PowerPoint 2002 SP2
Microsoft PowerPoint 2002 SP1
Microsoft PowerPoint 2002
Microsoft PowerPoint 2000 SP3
Microsoft PowerPoint 2000 SP2
Microsoft PowerPoint 2000 SP1
Microsoft PowerPoint 2000

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Apply the most recent upgrade or patch from the vendor:
http://www.microsoft.com/technet/security/Bulletin/MS09-017.mspx

CVE References

CVE-2009-1137