length: 00:21:40

most critical:

MS08-014: vulnerabilities in Excel that could allow remote code execution if a user opens a specially crafted Excel file.

MS08-017: vulnerabilities in Office Web Components. These vulnerabilities could allow remote code execution if a user viewed a specially crafted Web page.

People has been burn by Active-X for so many time, this has lead to government release recommendation not to use IE

Drastic time bring to drastic measure

Active-X web component of office , can be drive-by

The words of M$ must trick user to click malicious website make it sounds more difficult than what really is

The was security advisory in January related to 0day that was expected to be patched in the previous patch Tuesday – finally released today

Outlook: capable of remote codeexec – via email

Espionage payload

M$ recommendation: by setting killbits – most people cannot be bother to update AV, they don’t even know what is killbit???