Slashdot Log In
How Do You Handle New MS Word Vulnerabilities?
Posted by
Cliff
on Fri Dec 15, 2006 03:35 PM
from the it-maybe-time-to-look-into-a-new-word-processor dept.
from the it-maybe-time-to-look-into-a-new-word-processor dept.
chipperdog asks: "With yet another zero-day exploit of MS-Word document files, what are fellow system admins doing to protect themselves against these threats? I have been blocking all .doc and .dot at the mail and proxy servers until malware scanners have signatures to detect and block the malicious files. Of course, this caused a uproar with the users, as there were continuous calls like: 'When can I send and receive Word files again' and 'I can't get anything done if I can't send/receive Word files'. Any suggestion of sending documents in different formats (like rtf, html, txt, or pdf) results in even more creative user 'feedback'. Has anyone done anything creative in their handling of word files — like having qmail-scanner pipe all .doc attachments through something such as wv to convert them to a less exploitable format?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
You can't... (Score:5, Insightful)
Re: (Score:2)
Because MS's proprietary formats mean that the vulnerabilities in their code preclude easy backup plans should a new exploit like this come out.
I would say that MORE businesses need to be crippled by the threat of infection via Word. Maybe then the powers-that-be in those companies will start looking long and hard at alternatives to Word and software with other proprietary formats. Advise the PHBs: "Well, look, you can either take the risk of $HORRIBLE_WORM_ATTACK or you can deal with no
Re: (Score:2)
I question your use of the word "no" here. I think you are incorrect. Proof of concept exploits are out there and I think it's a matter of time before something nasty gets released.
I'll agree that at least for now the risk is low, but I think that's going to change over time. Further, one needs to assess risk vs. loss. Our shop is a mid-sized lab. We can afford to spend a few hours a week of our IT staff sifting manually through filtered DOC attachments. The consequences of a
Re: (Score:3, Insightful)
Why would banning Word documents bring your company to a halt? Word will open RTF files (for example) just as automatically as it will it's native format. It can save as RTF almost as easily as it's native format, it's at most 2-3 extra keystrokes once in the entire lifetime of the document. RTF handles all the text formatting, images and such that Word's native format does. The only things it doesn't support are the active content and such that malware uses, and I don't see that as a problem. So why should
Re: (Score:3, Insightful)
Just use OpenOffice rather than cutting them off (Score:3, Insightful)
OpenOffice also runs on more platforms & is developing faster, & the docs are much easier to externally process (they’re basically ZIPped XHTML in a moderately sane format).
Oh, yes, and it’s much cheaper ($0 per seat) &
At least for now we filter... (Score:3, Informative)
It's frustrating for the end user as they don't have instant access to their attachment (sometimes there's a 4-hour delay before the file can be manually inspected -- still waiting for some def-files!) and it's taxing my staff time-wise to do this (we've got better things to do than check for any monkey-business in word documents). We've suggested everyone convert to PDFs and send THOSE and it's been working but it's still a disruption.
Re: (Score:3, Informative)
"Do not rely on file-name extension filtering. In most cases, Windows will call Word to open a document even if the document has an unknown file extension. For example, if document.qwer contains the correct file header information, Windows will open document.qwer with Word. Filtering for common extensions such as
source [eweek.com]
Re: (Score:2)
Thanks for your concern.
strings (Score:2)
(I'm almost serious).
Rename the files (Score:2)
Re: (Score:2, Funny)
Re:Rename the files (Score:5, Insightful)
Parent
Re: (Score:2)
Clueless users can't be trained. IT people have been trying to train them for years, but the malware problem keeps getting worse because these users can't grasp very simplistic concepts. What amazes me is that companies continue to hire people like this that need t
Open Office (Score:4, Interesting)
Re: (Score:2)
(1) Portable Open Office: http://portableapps.com/apps/office/openoffice_por table [portableapps.com]
It is "no-install" in the sense that the file you download just unzips OO into a folder for you.
If the download size is a big deal, (2) Portable Abiword [portableapps.com] is much smaller, but only does basic word processing stuff.
Re: (Score:2)
The stick. (Score:2)
Heh.
The bulk of our traffic here is excel and powerpoint, so limiting word documents hasn't been a real problem. Additionally, corporate used to require stupidly high end router hardware in all parts of the building which was abusive on the budget, but, at times like this, comes in han
Wow... glad you don't work for me. (Score:5, Insightful)
A better solution is to educate the users - send out a mass email explaining the vulnurability, that you shouldn't be opening and doc's you aren't expecting. If you do it is your own damn fault and the timeliness of the fixing of your machine can not be guaranteed. There is no reason to choke business as you have and quite frankly the users have every reason to be upset.
Re:Wow... glad you don't work for me. (Score:4, Insightful)
Parent
Re: (Score:2)
Re: (Score:2)
Too bad the resume is the .doc file. We'll put you down under a list of "people who just don't get it". Unless you were trying to be funny. Then we can put you down on the list of "people with no sense of humor".
Re: (Score:2)
Re: (Score:3, Informative)
Users then access the pdf files from the 'safe' area normally, if you want to just ha
Re: (Score:3, Interesting)
I like the position my ISP's HR people take: "The posting said "No Word documents accepted.". The job's as a senior network engineer. It's going to require lots of detective work to troubleshoot obscure and arcane problems. If you can't figure out how to use Word's "Save As" to save in RTF or HTML, you are not qualified for the position. If you can't figure out that "No Word Documents accepted." means we won't be accepting Word documents, you aren't qualified for any position.".
Re: (Score:2)
Welcome to corporate, employee number 877346...
Zip the files (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Its pays to be thorough (Score:5, Funny)
The simplest way. (Score:4, Insightful)
Quarantine (Score:3, Insightful)
When we have viruses exploiting Word files, part of our security team sends out a notice that says we're temporarily quarantining the files until we can have them cleared. But really, you can't indefinitely stop word files from coming in.
I'll admit I'm too lazy to read the exact detail of the exploit, but shouldn't this whole situation be alleviated by good, layered network security anyway?
Re: (Score:2)
Well, the latest vulnerability allows a malicious word doc to run code on the users machine. Assuming I wrote a userspace piece of malware, I could easy start sending stuff (anything the user has access to, theoretically) out port 80 to a collection point. Since windows will open documents with unknown extension but proper Word headers in word, filterin
Scan, rinse, repeat. (Score:2)
Right now there's no good RPC-exploitable worm for Windows. Any word-based infection is going to be localized to a single machine (or, at most, to those machines a user has remote local administrative rights on). So, we watch. We stay at yellow allert, and we don't panic. Because right now, there's nothing to panic about. The ability to spread a virus/worm/mal* to a single mac
stripping macros (Score:2)
MIMEDefang.. customize mimedefang-filter (Score:5, Interesting)
Any attachments with a
Also to reduce the overhead, get the sha1sum for the word document, and save the pdf to
Before any documents are converted with openoffice, get the sha1sum. if a
This stills allows people to get the content, which is most of the time, all they want.
There is also a program called antiword that will convert ms word documents to text, PDF, or PostScript.
But openoffice does a better job.
Re: Antiword or Catdoc (Score:2, Informative)
Antiword: http://www.winfield.demon.nl/ [demon.nl]
Catdoc: http://www.45.free.net/~vitus/software/catdoc/ [free.net]
Add this to your
autocmd BufReadPre *.doc set filetype="msword"
autocmd BufReadPost *.doc silent %!antiword "%"
autocmd Filetype msword call s:MyMSWordSettings()
function! s:MyMSWordSettings()
set readonly
MOD PARENT INFORMATIVE (Score:3, Informative)
Thanks for the links. I know this problem isn't proven on OS X, but based on the executive summary I'd suppose it could be an issue, so to Mac OS X people, textutil(1) can read doc and convert to txt, html, rtf, or even webarchive, so you get all the images.
Textutil is in /usr/bin on an install of OS X, and just acts as a wrapper for the OS X text word processing subsystem.
The answer is obvious. (Score:2)
Yet more evidence of the truth and beauty of the Church of Emacs [dina.kvl.dk].
Or, if one is into truly antediluvian forms of worship, Ed, man! !man ed [gnu.org].
You should be limiting .DOC email exchange anyway (Score:4, Interesting)
- Exchanging finished documents for reading. PDF is better:
- It can reproduce the results exactly.
- It doesn't include Word's "change tracking" information which can cause embarrassing leaks.
- It's a standard with many interoperable implementations.
- Exchanging in-progress documents for revision. At least for stuff limited to your company, a version control server (like Subversion [tigris.org] with friendly TortoiseSVN [tigris.org] clients) is better:
- Doesn't cause email storage to grow enormously. Instead, a server actually meant for this kind of thing stores only deltas. And only one copy of each document - on most mailservers, the disk space consumed by an attachment is proportional to the number of recipients.
- Lets you easily find the latest version of a document. ("Did he send me another copy after this? I'm not sure.")
- Lets you easily retrieve any previous version, see changes/authors/checkin comments. (I don't trust Word's built-in change tracking, and you shouldn't either. Its security model is flawed, and I don't think it's reliable to begin with.)
- Supports locking/unlocking documents to prevent conflicting changes.
- With some setup, supports diffing and merging [tigris.org] office documents. You can maintain branches!
- Supports searching - where I work, we've plugged in swish-e [swish-e.org] for full-text searching over our documentation repository.
I wish my company would just block allRemove the root cause (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Informative)
Re: (Score:2)
Re:I don't (Score:4, Interesting)
Also, to the original question:
Scanning
From the e-week article:
"Do not rely on file-name extension filtering. In most cases, Windows will call Word to open a document even if the document has an unknown file extension. For example, if document.qwer contains the correct file header information, Windows will open document.qwer with Word. Filtering for common extensions such as
Parent
Re: (Score:3, Informative)
"Data used by Microsoft Word to construct a destination address for a memory copy routine is embedded within a Word document itself. If an attacker constructs a Word document with a specially crafted value used to build this destination address, then that attacker may be able to overwrite arbitrary memory,"
There's no way to protect from these documents via group policy, short of a group policy that disallows word from running.