Attack Surface Reduction

MS09-017: An out-of-the-ordinary PowerPoint security update

Tuesday, May 12, 2009

Security update MS09-017 addresses the PowerPoint (PPT) zero-day vulnerability that has recently been used in targeted attacks. We issued security advisory 969136 with workarounds on April 2nd after we first saw the exploits in-the-wild abusing this vulnerability. We also published an SRD blog entry describing how to analyze exploits and an MMPC blog entry with more details about the exploits we had seen.

Attack Surface Reduction
Exploitation
Microsoft Office

MS09-010: Reducing the text converter attack surface

Tuesday, April 14, 2009

MS09-010 addresses vulnerabilities in Word converters used by WordPad and by Office to load files saved in old file formats. Some of you probably saw this bulletin and thought “I never open documents from versions of Word prior to Word XP,” and you may be interested in reducing your attack surface.