Feeds

Microsoft releases security tool for Office 2003

Defangs Office doc, spreads the XML love

Top three mobile application threats

Microsoft has released a tool designed to protect Office 2003 users from malicious payloads surreptitiously dropped into innocent-looking office files - an attack tactic that has grown in popularity over the past year.

Called MOICE - short for Microsoft Office Isolated Conversion Environment - the enhancement converts Word, Excel and PowerPoint files to their counterparts in the OpenXML format. In the process, which takes place in a quarantined, sandbox environment, elements that could have been used to compromise a machine are effectively stripped out, Microsoft says.

MOICE is designed to be used alongside another tool known as File Block, which enables administrators to set up group policies that prevent users from accessing certain types of Office documents. File types that have been blacklisted are simply converted to corresponding files in the more benign XML format.

"During the conversion of an unsafe file, MOICE will fail to convert the file, create a safe version of the file, or the converter itself will crash," an advisory on Microsoft's site reads. "The mere process of conversion and achieving one of three possible outcomes is what protects customers."

Both protections already work out of the box with Office 2007. Office 2003 users who want to use them must first install the Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats. Organizations using versions prior to Office 2003 are out of luck. Microsoft has said it plans to "backport" some but not all of Office 2007's security improvements in the upcoming release of Service Pack 3 for Office 2003.

Microsoft is wise to extend these protections to Office 2003, which remains widely used by businesses and government and military agencies. Since the beginning of last year, Microsoft has issued at least 24 security advisories concerning Office 2003, according to Secunia. Office 2007, by contrast, has been affected by advisories just twice. MOICE and File Block alone can't provide all the protections found in Office 2007, but Microsoft is betting they can help contain damage from some of the nastiest exploits that might otherwise wreak havoc on organizations that have yet to upgrade.

Secunia data shows the growing popularity of Office as an attack vector. Of the 33 advisories issued over the past three years, 19 of them came in the past year. ®

MOICE, which is available free, works with the .doc, .ppt, .pot, .pps, .xls, .xlt and .xla file formats. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.