Discussion: Microsoft(R) PowerPoint “Action Settings” feature allows invocation of default browser pointed at arbitrary URL.

[Monte Ratzlaff <advisories () rinfosystems com>]

Discussion: Microsoft(R) PowerPoint “Action Settings” feature allows invocation of default browser pointed at arbitrary 
URL.  PowerPoint version tested: 2002 with SP3.

Reason for discussion:
For business reasons Microsoft(R) PowerPoint (ppt) files are allowed attachments in most enterprise email gateways.  
This discussion is aimed at the need for reviewing this policy.

When configured by the slide author, the PowerPoint “Action Settings” feature allows for some automatic activity.  
Although this feature is not new and there are a number of actions that can be performed with this feature, I offer two 
scenarios of one issue.

A victim is sent an email with a Microsoft(R) PowerPoint (ppt) file containing a slide with a picture or object which 
has “Action Settings” “Mouse Over” properties configured to visit a URL.
If the victim runs the PowerPoint show and moves the mouse over the picture or object the default browser is launched 
pointing to the URL as defined by the slide author in the “Action Settings: Mouse Over” properties.

Scenario 1:
Action Settings | Mouse Over | Hyperlink to: URL <malicious site>
ItÂ’s obvious there could be any malicious site pointed to here for scripting, spyware installation, phishing, etc.  
When the victim moves the mouse pointer over the picture/object the page is launched using the victimÂ’s default browser.

Mitigating factors for Scenario 1:
The victim would have to run the PowerPoint show and move the mouse over the picture/object.
The browser/system would need to be vulnerable to an exploit used in the script attack.

Scenario 2 (not thoroughly tested):
Action Settings | Mouse Over | Hyperlink to: URL \\<server_ip>\<share_dir>\<file>

When the victim moves the mouse pointer over the picture/object the following exchange occurs automatically.
An SMB NTLM challenge is sent to the victim's PC from the attacking server and the victim's PC will automatically 
respond to the challenge with an SMB NTLM authentication.
If the attacker is running a sniffer the victim's IP, SMB NTLM authentication (with the user name and password hash) is 
captured for future "analysis".

Mitigating factors for Scenario 2:

The victim would have to run the PowerPoint show and move the mouse over the picture/object.
Attacking server would have to allow incoming sessions.
The victimÂ’s PC would have to be allowed session information over the network/Internet (unconfirmed).

RELATED FACTS:
*While there is a social engineering component to these attacks is not uncommon for recipients to open ppt files, run 
the show, and either use the mouse to click through the show or click when prompted.
*Many Microsoft(R) vulnerabilities are stamped with the mitigating factor: "An attacker would have no way to force 
users to visit a malicious Web site."
*SPAMmers are continually changing the methods used to generate traffic to sites.
*Spyware is a problem plaguing many organizations.

Conclusion:
With the threat of phishing schemes, SPAM, spyware, malicious scripts, and vulnerable browsers/systems, the policy of 
allowing Microsoft(R) PowerPoint (ppt) files to pass through email gateways should be reviewed.