OpenOffice hits back at viral risk claims
Safe as houses
Posted in Enterprise Security, 15th August 2006 16:42 GMT
Free whitepaper – Vulnerability management buyer's checklist
OpenOffice.org has hit back at claims that the alternative office applications suite is riddled with security holes. Researchers at the French Ministry of Defense say that OpenOffice is subject to security weaknesses that make it at least as susceptible to computer viruses as the commercial, more widely used, Microsoft Office.
The French research paper, entitled an In-depth analysis of the viral threats with OpenOffice.org documents (PDF), looked at four proof-of-concept viruses and a variety of attack scenarios before concluding that the "general security of OpenOffice is insufficient," IDG reports. Among the risks highlighted were the possibility of creating malicious macros targeting OpenOffice documents.
"The viral hazard attached to OpenOffice.org is at least as high as that for the Microsoft Office suite, and even higher when considering some... aspects," the researchers, information security specialists at the French Ministry of Defense's Signal Corps, said. Their paper is due to be published Paris-based Journal in Computer Virology.
Aside from making the obvious point that Microsoft Office is the frequent target of viral attack, unlike OpenOffice, the developers behind the open source desktop productivity suite say a software bug discovered by the French researchers has already been fixed. "The one real flaw in the programming logic has been fixed," Louis Suarez-Potts, an OpenOffice.org community manager, told IDG. "The others are theoretical."
Nonetheless OpenOffice.org has opened up a dialog with the French researchers with the aim of improving the overall security of the software suite. ®


Airport insecurity: the case of lost laptops
Reducing messaging and web security costs with managed services
Avoiding 7 common mistakes of IT security compliance
Extended Validation SSL Certificates
Feds: Hospital hacker's 'massive' DDoS averted
Microsoft knew of nasty IE bug a year before attacks
BlockMaster SafeStick hardware-encrypted USB drive