Microsoft Warns of PowerPoint Attack

narramissic writes to let us know about yet another PowerPoint flaw, this one affecting PowerPoint 2000, 2002, and 2003, soon after Microsoft issued a record number of patches to fix numerous Office vulnerabilities (among others). The new problem came to light in a blog posting by Microsoft Security Program Manager Alexandra Huft, but the coverage at ITWorld has more detail. Huft writes, "We've been made aware of proof of concept code published publicly affecting Microsoft Office 2003 PowerPoint," and goes on to say that Microsoft is not aware of any attacks that exploit the bug.

Comments

Powerpoint Poisoning is the real threat..

[Channard]

... I've seen plenty of presentations where the content has been so obscured by all the bells and whistles the user has added. While they're fixing the bug, maybe Microsoft can add a 'View Presentation in Minimalist Mode' option to Powerpoint.

Re:Powerpoint Poisoning is the real threat..

[Z34107]

Microsoft should have a short "style guide" that appears the first time a user account starts powerpoint. It would have a nice list of my pet peeves, including:

• All slids should use the background image. The image should not just be a rectangle you drew over a blacnk slide because you were too stupid to click file->new, and if all else, it should not show a different seizure-inducing color every slide.
• Your powerpoint should never feature sound effects. This feature was included as a test to determine which people will make it onto Microsoft's colonization ship to Mars should anything apocalyptically uncool happen on Earth.
• Animation should be limited to making your bullet points appear one at a time. The text itself should not be used to induce seizures.
• Ues spl3ll chkec.
• Don't copy and paste what you're going to read, word for word, onto your slides a paragraph at a time.

How much pain would I have been saved if people would just follow these simple rules. Or stop their presentation when a representative sample of (captive) audience members experience retinal bleeding.

Not really a problem with bells and whistles, per se - Powerpoint's a nice, powerful app capable of creating really professional presentations. Just that there's a "max capacity" on each slide for flash. If x is the number of bells, whistles, and features (ab)used per slide, comprehension and aesthetic appeal, and the audience's opinion of the presentor have their limit lim x->oo = 0.

Re:Good.

[cryfreedomlove]

Really? You just walk out? Where do you work? What's your position in the company?

Power Point Attack

[Anonymous Coward]

That's the way I feel when I'm at a presentation that using that shit - attacked!

Hey Microsoft!

[Anonymous Coward]

What's with the sudden interest in security? If I didn't know better, I'd think you had a new OS release imminent:P

What gives?

Nothing new

[msuzio]

I think every presentation I've ever seen with flying graphics, pie charts, bullet points zooming in from the left, and all the other PowerPoint abuses a sales or marketing droid can think up in his voluminous spare time off the golf course, would definitely qualify as "PowerPoint Attacks".

Re:Good.

[TobyRush]

I don't use PowerPoint. When I go to a meeting, which is often, I immediately leave the room if someone decides to bore me with stupid phrases in 12-centimetre type.

To be fair, that's not PowerPoint's fault; it's a lack of presentation skill that seems to pervade the business culture today. If I am talking finances and I have a $2000 laptop and a $4500 projector displaying this on the screen:

Finances
- income
- spending

...then it doesn't matter what software I'm using, I'm wasting resources. PowerPoint has a lot of functionality that can be used to enhance presentations but most people don't use it. So they could really just use a word processor or slideshow program to do practically the same thing.

If you want bash PowerPoint (and I realize that wasn't necessarily the parent's goal), try this: the interface STINKS. I haven't used OpenOffice or StarOffice, but if they are trying to emulate PowerPoint's interface, then I won't bother.

<fanboi>I'm a Mac user and Keynote is much, MUCH more elegant to use... and can even import and export PowerPoint files.</fanboi>

Does all Microsoft content have to be executable?

[Animats]

Microsoft has this annoying policy of putting some kind of general purpose execution engine in every Office product, from Word to PowerPoint to IE. Documents don't have to be Turing-complete, people. In fact, they're more useful if they're purely declarative - you can repurpose the content.

(Postscript is the classic bad example. The Postscript model is explicitly an interpreter. As a result, it's difficult to do anything with a Postscript document other than print it in the specified format. Text extraction is tough. Reliable format conversion is very tough. Reliable conversion to a different screen size, which ought to be easy, is terribly hard. Everybody moved away from Postscript, even Adobe. Microsoft should have learned from this.)