Executive Summary
Summary | |
---|---|
Title | Release of Microsoft Office File Validation for Microsoft Office |
Informations | |||
---|---|---|---|
Name | KB2501584 | First vendor Publication | 2011-04-12 |
Vendor | Microsoft | Last vendor Modification | 2011-06-30 |
Severity (Vendor) | N/A | Revision | 2.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : | |||
---|---|---|---|
Cvss Base Score | Not Defined | Attack Range | Not Defined |
Cvss Impact Score | Not Defined | Attack Complexity | Not Defined |
Cvss Expoit Score | Not Defined | Authentication | Not Defined |
Calculate full CVSS 2.0 Vectors scores |
Detail
Microsoft is announcing the availability of the Office File Validation feature for supported editions of Microsoft Office 2003 and Microsoft Office 2007. The feature, previously only available for supported editions of Microsoft Office 2010, is designed to make it easier for customers to protect themselves from Office files that may contain malformed data, such as unsolicited Office files received from unknown or known sources, by scanning and validating files before they are opened. The Office File Validation feature described in this advisory applies when opening an Office file using Microsoft Excel 2003, Microsoft PowerPoint 2003, Microsoft Word 2003, Microsoft Publisher 2003, Microsoft Excel 2007, Microsoft PowerPoint 2007, Microsoft Word 2007, or Microsoft Publisher 2007. Office File Validation helps detect and prevent a kind of exploit known as a file format attack. File format attacks exploit the integrity of a file, and occur when the structure of a file is modified with the intent of adding malicious code. Usually the malicious code is run remotely and is used to elevate the privilege of restricted accounts on the computer. As a result, an attacker could gain access to a computer that was not previously accessible. This could enable an attacker to read sensitive information from the computers hard disk drive or to install malware, such as a worm or a key logging program. The Office File Validation feature helps prevent file format attacks by scanning and validating files before they are opened. To validate files, Office File Validation compares a files structure to a predefined file schema, which is a set of rules that define what a readable file looks like. If Office File Validation detects that a files structure does not follow all rules described in the schema, the file does not pass validation. File format attacks occur most frequently in files that are stored in Office binary file formats. For this reason, Office File Validation scans and validates the following kinds of files: By default, files that fail validation generate the following warning message: Files that fail validation do not open; however, by default, the user is provided the choice to open the file anyway. Choosing to open a file that has failed validation is not recommended as the file could be malicious. This advisory discusses the following software. Why was this advisory revised June 30, 2011? Customers can install the Office File Validation Add-in by checking online for updates from Microsoft Update or by using the Microsoft Update service. Customers who have already installed the Office File Validation Add-in manually will not be offered the add-in and do not need to take additional action. What is the scope of the advisory? Are there any known issues with the Microsoft Office File Validation feature? How does Office File Validation protect? Files that fail validation do not automatically open. Instead, the user has to click through a warning indicating that opening the file could be dangerous in order to open the file. How do the security updates released on April 12, 2011 relate to the Office File Validation feature? There were no security updates released on April 12, 2011 for Microsoft Word and Microsoft Publisher. Where are the updates for Microsoft Word and Microsoft Publisher? What is the Office File Validation add-in? How can I install the Office File Validation add-in and prerequisite updates? As of June 28, 2011, the Office File Validation Add-in can also be installed by checking online for updates from Microsoft Update or by using the Microsoft Update service. Can I use this new feature with Microsoft Office XP? How does this advisory relate to Office File Validation for Microsoft Office 2010? How can I change Office File Validation settings? Note The above behavior is in Microsoft Office 2003 and Microsoft Office 2007 and is different than the behavior in Microsoft Office 2010. In Microsoft Office 2010, files that fail validation open in Protected View; the user then must click through several warning messages before the file can be opened for editing. Note The above behavior is in Microsoft Office 2003 and Microsoft Office 2007 and is different than the behavior in Microsoft Office 2010. In Microsoft Office 2010, files that fail validation open in Protected View; the user is then prevented from opening the file for editing. For more information on Office File Validation settings and to use the automated Microsoft Fix it solutions to configure Office File Validation settings, see Microsoft Knowledge Base Article 2501584. How can I disable Office File Validation? For information on disabling the Office File Validation feature, see TechNet article, Office File Validation for Office 2003 and Office 2007. Microsoft does not recommend disabling Office File Validation. Office File Validation is a key part of the layered defense strategy in Microsoft Office and should be enabled on all computers throughout an organization. In Microsoft Office 2007, for customers that want to prevent files from being validated by the Office File Validation feature, Microsoft recommends using the Trusted Locations feature. Files that are opened from trusted locations skip Office File Validation checks. How does the Office File Validation feature change the user experience when opening and inserting files in to Microsoft Publisher? Consult TechNet article, Office File Validation for Office 2003 and Office 2007, for information on deployment, installation, and configuration of the Office File Validation feature for Microsoft Office 2003 and Microsoft Office 2007. |
Original Source
Url : http://www.microsoft.com/technet/security/advisory/2501584.mspx |
Alert History
Date | Informations |
---|---|
2013-02-06 19:08:06 |
|