Original URL: http://www.theregister.co.uk/2007/05/22/office_moice/
Microsoft releases security tool for Office 2003
Defangs Office doc, spreads the XML love
Microsoft has released a tool designed to protect Office 2003 users from malicious payloads surreptitiously dropped into innocent-looking office files - an attack tactic that has grown in popularity over the past year.
Called MOICE - short for Microsoft Office Isolated Conversion Environment - the enhancement converts Word, Excel and PowerPoint files to their counterparts in the OpenXML format. In the process, which takes place in a quarantined, sandbox environment, elements that could have been used to compromise a machine are effectively stripped out, Microsoft says.
MOICE is designed to be used alongside another tool known as File Block, which enables administrators to set up group policies that prevent users from accessing certain types of Office documents. File types that have been blacklisted are simply converted to corresponding files in the more benign XML format.
"During the conversion of an unsafe file, MOICE will fail to convert the file, create a safe version of the file, or the converter itself will crash," an advisory on Microsoft's site reads. "The mere process of conversion and achieving one of three possible outcomes is what protects customers."
Both protections already work out of the box with Office 2007. Office 2003 users who want to use them must first install the Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats. Organizations using versions prior to Office 2003 are out of luck. Microsoft has said it plans to "backport" some but not all of Office 2007's security improvements in the upcoming release of Service Pack 3 for Office 2003.
Microsoft is wise to extend these protections to Office 2003, which remains widely used by businesses and government and military agencies. Since the beginning of last year, Microsoft has issued at least 24 security advisories concerning Office 2003, according to Secunia. Office 2007, by contrast, has been affected by advisories just twice. MOICE and File Block alone can't provide all the protections found in Office 2007, but Microsoft is betting they can help contain damage from some of the nastiest exploits that might otherwise wreak havoc on organizations that have yet to upgrade.
Secunia data shows the growing popularity of Office as an attack vector. Of the 33 advisories issued over the past three years, 19 of them came in the past year. ®
MOICE, which is available free, works with the .doc, .ppt, .pot, .pps, .xls, .xlt and .xla file formats. ®