Feeds

Microsoft releases security tool for Office 2003

Defangs Office doc, spreads the XML love

Security for virtualized datacentres

Microsoft has released a tool designed to protect Office 2003 users from malicious payloads surreptitiously dropped into innocent-looking office files - an attack tactic that has grown in popularity over the past year.

Called MOICE - short for Microsoft Office Isolated Conversion Environment - the enhancement converts Word, Excel and PowerPoint files to their counterparts in the OpenXML format. In the process, which takes place in a quarantined, sandbox environment, elements that could have been used to compromise a machine are effectively stripped out, Microsoft says.

MOICE is designed to be used alongside another tool known as File Block, which enables administrators to set up group policies that prevent users from accessing certain types of Office documents. File types that have been blacklisted are simply converted to corresponding files in the more benign XML format.

"During the conversion of an unsafe file, MOICE will fail to convert the file, create a safe version of the file, or the converter itself will crash," an advisory on Microsoft's site reads. "The mere process of conversion and achieving one of three possible outcomes is what protects customers."

Both protections already work out of the box with Office 2007. Office 2003 users who want to use them must first install the Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats. Organizations using versions prior to Office 2003 are out of luck. Microsoft has said it plans to "backport" some but not all of Office 2007's security improvements in the upcoming release of Service Pack 3 for Office 2003.

Microsoft is wise to extend these protections to Office 2003, which remains widely used by businesses and government and military agencies. Since the beginning of last year, Microsoft has issued at least 24 security advisories concerning Office 2003, according to Secunia. Office 2007, by contrast, has been affected by advisories just twice. MOICE and File Block alone can't provide all the protections found in Office 2007, but Microsoft is betting they can help contain damage from some of the nastiest exploits that might otherwise wreak havoc on organizations that have yet to upgrade.

Secunia data shows the growing popularity of Office as an attack vector. Of the 33 advisories issued over the past three years, 19 of them came in the past year. ®

MOICE, which is available free, works with the .doc, .ppt, .pot, .pps, .xls, .xlt and .xla file formats. ®

Secure remote control for conventional and virtual desktops

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.