Feeds

Microsoft releases security tool for Office 2003

Defangs Office doc, spreads the XML love

Securing Web Applications Made Simple and Scalable

Microsoft has released a tool designed to protect Office 2003 users from malicious payloads surreptitiously dropped into innocent-looking office files - an attack tactic that has grown in popularity over the past year.

Called MOICE - short for Microsoft Office Isolated Conversion Environment - the enhancement converts Word, Excel and PowerPoint files to their counterparts in the OpenXML format. In the process, which takes place in a quarantined, sandbox environment, elements that could have been used to compromise a machine are effectively stripped out, Microsoft says.

MOICE is designed to be used alongside another tool known as File Block, which enables administrators to set up group policies that prevent users from accessing certain types of Office documents. File types that have been blacklisted are simply converted to corresponding files in the more benign XML format.

"During the conversion of an unsafe file, MOICE will fail to convert the file, create a safe version of the file, or the converter itself will crash," an advisory on Microsoft's site reads. "The mere process of conversion and achieving one of three possible outcomes is what protects customers."

Both protections already work out of the box with Office 2007. Office 2003 users who want to use them must first install the Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats. Organizations using versions prior to Office 2003 are out of luck. Microsoft has said it plans to "backport" some but not all of Office 2007's security improvements in the upcoming release of Service Pack 3 for Office 2003.

Microsoft is wise to extend these protections to Office 2003, which remains widely used by businesses and government and military agencies. Since the beginning of last year, Microsoft has issued at least 24 security advisories concerning Office 2003, according to Secunia. Office 2007, by contrast, has been affected by advisories just twice. MOICE and File Block alone can't provide all the protections found in Office 2007, but Microsoft is betting they can help contain damage from some of the nastiest exploits that might otherwise wreak havoc on organizations that have yet to upgrade.

Secunia data shows the growing popularity of Office as an attack vector. Of the 33 advisories issued over the past three years, 19 of them came in the past year. ®

MOICE, which is available free, works with the .doc, .ppt, .pot, .pps, .xls, .xlt and .xla file formats. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.