Feeds

MS anti-piracy feature trips up Office for Mac

Ironic, but low-risk, security flaw

  • alert
  • submit to reddit

The essential guide to IT transformation

An anti-piracy feature in Microsoft Office for Mac has been linked to a denial of service risk, prompting Microsoft to issue a security fix.

A feature of the Office v. X software suite, called the Network Product Identification (PID) Checker, detects multiple copies of Office using the same product identifier running on a local network. If a duplicate PID is detected, Office shuts down.

However the software contains a flaw which means that the Network PID Checker doesn't correctly handle a particular type of malformed announcement. This will cause the process to crash, bringing the first loaded application down with it.

In a security notice, Microsoft said; "An attacker could use this vulnerability to cause other users' Office applications to fail, with the loss of any unsaved data.

"An attacker could craft and send this packet to a victim's machine directly, by using the machine's IP address. Or, he could send this same directive to a broadcast and multicast domain and attack all affected machines," it adds.

Any properly configured firewall should block such a malformed request sent over the Internet, and broadcast and multicast traffic should also be restricted on a properly set up network. This, along with the fact the vulnerability can't be used to modify data or crash other applications running on a machine, restricts its seriousness.

Microsoft categorises the vulnerability as low risk and has issued a patch for Microsoft Office v. X that fixes the glitch. ®

Related stories

How I learned to stop worrying, and abandoned Mac OSX
AOL launches Mac OS X software
M$ unveils Office for OS X
Naked at the Moscone: the MacWorld Expo Round-Up

5 things you didn’t know about cloud backup

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
No, thank you. I will not code for the Caliphate
Some assignments, even the Bongster decline must
Barnes & Noble: Swallow a Samsung Nook tablet, please ... pretty please
Novelslab finally on sale with ($199 - $20) price tag
Banking apps: Handy, can grab all your money... and RIDDLED with coding flaws
Yep, that one place you'd hoped you wouldn't find 'em
Video of US journalist 'beheading' pulled from social media
Yanked footage featured British-accented attacker and US journo James Foley
Primetime precrime? Minority Report TV series 'being developed'
I have to know. I have to find out what happened to my life
Netflix swallows yet another bitter pill, inks peering deal with TWC
Net neutrality crusader once again pays up for priority access
Judge nixes HP deal for director amnesty after $8.8bn Autonomy snafu
Lawyers will have to earn their keep the hard way, says court
Ex-IBM CEO John Akers dies at 79
An era disrupted by the advent of the PC
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.