Jul 8 CVE-2009-0556 China and the Cheonan Incident vargas43@hotmail.com

CVE-2009-0556 Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."

 Download  a362abe459c574b1984640316219c818 Presentations.pps as a password protected archive (contact me if you need the password)

From: Jorge Vargas [mailto:jorge.vargas43@hotmail.com]
Sent: Thursday, July 08, 2010 3:02 AM
To: XXXXXXXXXXX
Subject: China and the Cheonan Incident

China and the Cheonan Incident 

Author : David Kang Published
The Chinese are facing widespread criticism for their behavior following the Cheonan incident
______________________________________
Hotmail: Free, trusted and rich email service. Get it now.

 File Presentations.pps received on 2010.07.10 17:11:12 (UTC)
http://www.virustotal.com/analisis/e22805d4f845c42d801e6b2b87782716a01c2db0553e2b4da7eda355ba28cdcf-1278781872
Result: 8/41 (19.52%)
BitDefender    7.2    2010.07.10    Exploit.PPT.Gen
F-Secure    9.0.15370.0    2010.07.09    Exploit.PPT.Gen
GData    21    2010.07.10    Exploit.PPT.Gen
McAfee-GW-Edition    2010.1    2010.07.05    Heuristic.BehavesLike.Exploit.P97.CodeExec.PGPG
Norman    6.05.11    2010.07.10    ShellCode.D
nProtect    2010-07-10.01    2010.07.10    Exploit.PPT.Gen
Sophos    4.55.0    2010.07.10    Troj/ExpPPT-A
TrendMicro-HouseCall    9.120.0.1004    2010.07.10    HEUR_OLEXP.B
Additional information
File size: 838144 bytes
MD5...: a362abe459c574b1984640316219c818

Headers

Received: from SNT127-W1 ([65.55.90.136]) by snt0-omc3-s15.snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
     Thu, 8 Jul 2010 00:01:36 -0700
Message-ID:
Return-Path: jorge.vargas43@hotmail.com
Content-Type: multipart/mixed;
    boundary="_dafedb01-4726-4c6a-ab40-94312905e44c_"
X-Originating-IP: [69.64.56.19]
From: Jorge Vargas
To: xxxxxxxxxxxx
Subject: China and the Cheonan Incident
Date: Thu, 8 Jul 2010 08:01:36 +0100
Importance: Normal
MIME-Version: 1.0
X-OriginalArrivalTime: 08 Jul 2010 07:01:36.0526 (UTC) FILETIME=[67FE8AE0:01CB1E6B]

Hostname: usloft1344.serverloft.com
ISP: Hosting Solutions International
Organization: INTERLAND
Proxy: Suspected network sharing device.
Country: United States  
State/Region: Georgia
City: Atlanta