Slashdot Mirror
Microsoft Word Security Flaw
JWL-23 writes: "cnn.com is reporting that a Microsoft Word flaw may allow file theft. Furthermore, they plan on not fixing Word 97, leaving millions of users out in the cold. Yet another reason to try OpenOffice.org." It still takes more than running Word to expose the contents of your hard drive though.
I loved this one:
"It's incredible to me that Microsoft would turn its back on Word 97 users," said Woody Leonhard, who has written books on Microsoft's Word and Office software. "They bought the package with full faith in Microsoft and its ability to protect them from this kind of exploit."
To paraphrase Douglas Adams, "Bill says, 'I refuse to fix bugs, for patches deny faith, and without faith I am nothing.' "
>Well, that sounds like an excellent motivator to
>try harder to get it right the first time!
Name one major software product that has been bug-free from initial release.
For that matter, name one major software product that has ever been bug-free at any point in its lifetime.
-l
Yet another reason why MS Word is not a document exchange format. That rant is also avaible in other formats
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
Analyst Laura DiDio of the Yankee Group said companies are taking a risk by using such old software, but Microsoft should correct the problem because of its severity.
I am having a hard time getting my head around the concept that newer software equals software with "less risk". I do not understand why a product, open or closed, is inherently more "risky" due to its age. Perhaps she means un-patched old software? Is she advising users of a genuine risk, or is she making the case for a revenue stream and saying that IS Managers who do not stay "less old" in their application selections are jeopardizing their companies? Although she admonishes Microsoft to fix the problem, it seems her implication is that said managers are negligent, as opposed to the software vendor who may or may not patch the hole they wrote.
"Furthermore, they plan on not fixing Word 97, leaving millions of users out in the cold."
That's not entirely true. It is true that before this story broke, Microsoft had no plans on updating or offering any new fixes for anything '97.
However, CNN and AP reported this morning that Micorsoft hasn't ruled out a fix and that they are in the process of determining what it would take to make a fix available.
>>product that has been bug-free from initial release
Citronella candles?
1) IMHO the emphasis on Word97 is wrong. I originally tested this on Word2000 and it worked perfectly.
2) I was not out to find yet another M$ bug. I was using Word for my daily work when I stumbled onto this. It was one of those "I wonder what this button does" things.
3) The vulnerability is actually a lot more serious than the AP and bugtraq posts reveal. There is actually a way to skip the last step where the victim returns the bugged file. In other words, just editing and saving (or printing) the bugged file is sufficient. Look for a new bugtraq post early next week.
I'm not making any accusations *cough*, but does this strike anyone else as a great addition to Microsoft's "fuck them over and make them upgrade" business model? Leave a product full of security flaws, and, years later, when people aren't upgrading to the new version, refuse to fix security flaws in the old versions.
t tp://news.com.com/2100-1001-253578.html?legacy=c net
Refer to:
http://news.com.com/2100-1001-273276.html
h
"play up what a nightmare Microsoft malware is, and how easy and free OS software is"
No, I'd say use your head and give some insightful advice, rather than spout off like a ranting zealot. Don't "play up" anything. Give the truth.
Don't lie about how easy it is to install and configure the OSS equivalents. Don't pretend they're going to be 100% compatible. And in gods name, stop with the "microsoft owns your soul" rants. Once that user realises you lied, there goes your credibility, your 'stroke'. Next time they'll ask for advice from the kid at the counter of the local Office Depot.
If OSS is going to 'empower' people, it won't be through a bunch of FUD and politics. Let it sink or swim on its own virtues.
This isn't a message directed at you, but rather to all who want to actually help open source be taken seriously.
I don't need no instructions to know how to rock!!!!
Just another argument for using open-source software whenever you possibly can. If you discover a bug like this and the author isn't willing to fix it, you can always fix it yourself. Why would you ever want to leave this decision to someone else?
Yeah, 'cuz whenever I suspect a shortcoming in the Linux kernel, I break out emacs and beat it back into shape. Right. After I correct any perceived shortcomings in emacs, that is.
I could always hire or convince someone else to fix a problem for me (with open source software), but that might rapidly amount to an obscene monetary of temporal cost (for an individual to bear) after adding up each fix requested, and doing so still leaves the decision to someone else.
So, I basically have to be able to (a) understand and (b) correct the code "behind" the software packages I use in order to derive full benefit from open source software? That line of thinking doesn't seem very compelling to me.
Nine times out of ten (at least), the only difference is that I, as an end-user, am waiting for a different group of people to improve the products I use. Maybe they'll fix it, maybe they won't -- because, as you point out:
Food for thought?
I'm on the same boat. I definately couldn't fix security holes in the software I run (especially considering that I'd have to have a fscking HUGE /usr/src partition). Even if I could, I don't know if I would trust the patch since:
1: I didn't write the software in the first place.
2: I'm not a full time programmer, I'm an administrator.
Can all fish swim?
FTA:
But, referring to Microsoft engineers, McGee said "there's only so far back they can go."
No. There's only so far back they WILL go. There is a HUGE difference. Microsoft has CHOSEN not to support it, it's not that they can't.
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Agree with the principle, however a Rare chance at file theft and a FATAL FLAW in an automobile are not even close to realistic comparisons...
Razzious Domini
I could be a GREAT KARMA WHORE if I could just shed the few morals I have left.
The logic of this eludes me.
If you are using Word97 and somebody else is using WordXP. The other person will get the patch.
Opensource software now...
You are using KDE1 and somebody else is using KDE3. Security Hole X that is in both. KDE3 will get 'patched' or at least fixed, I doubt that KDE1 will get fixed. The only benefit here is that you could potentially fix it yourself, but if you are using KDE1 i doubt you really would.
What we see depends on mainly what we look for. -- John Lubbock Now search for that bug slave!
View some of the past word docs you've received in a hex editor...
Near the bottom there is often information from other documents of the sender that they were recently working on. I don't know why it saves this. Maybe something to do with the undo buffer?
At work I used to look at internal memos that would be sent out on a weekly basis and find out all sorts of other stuff that was going on.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
I'm only coming from personal experience, in particular an experience we had at work with SaMBa.
We had this paper tiger straight from the "newbie factory" of the local college. We had a task for a particular client, which boiled down to a fileserver with a big shared folder for images (photos).
So, this kid starts immediately frothing at the mouth about linux and SaMBa. He lied (probably out of ignorance) about how it's completely seamless on a Win2k network. He ranted about how much we'll save by not having to pay to liscense another copy of Win2k for the client.
Well, he got the marketing types convinced. Next thing I know, we're (we as in ME, I do the work around here) knee deep in all the kludges, hacks and nonsense involved in getting the SaMBa box to work exactly as we wanted it to, logging onto the Win2k domain, retrieving user lists, faking NTFS security, etc.
The management, the client, everyone involved became increasingly frustrated.
Long story short, we pissed away countless man-hours before finally acquiescing and just installing another Win2k pro box, which took all of 5 minutes to configure.
The kid has since left, and now about 6 months later, I have other projects that scream for the likes of linux, SaMBa, MySQL. Noone in this office wants to hear it, and think I've become some sort of zealot.
To me, it's just a matter of the right tool for the right job. SaMBa wasn't the right tool for that task, but it is for others. But the frenzied ideology has basically driven it out of this office, at least for the time being.
It's just an anecdotal example of how one well-meaning zealot can do much more damage than good. It happens to be one of my pet peeves.
So, in the meantime, I continue to advocate OSS solutions where they're practical. And its slowly but surely working. I was actually allowed to use a spare pentium box and CoyoteLinux to replace a buggy router in our testing 'bullpen'.
I guess I don't see OSS as 'a cause'. I try to think through problems logically and practically. Sometimes OSS is a logical, practical solution. Sometimes not. I just hate my options being slowly limited as people in the 'industry' line up on one side of the imaginary fence of the other.
I don't need no instructions to know how to rock!!!!
Open source developers are more responsible than closed source developers? Could you please tell me why?
It's so difficult to define what constitutes a "major" problem, and what the seller should be obligated to fix.
Does it work as a word processor? Will it allow you to read, write, print, and format documents? Well if it didn't do those, then I would say it is a major problem. If it emailed personal information to random people on start up, then I would call it a problem, or if it caused your firewall software to crash everytime you opened a .doc file, I would call it a major problem.
If you discover a bug like this and the author isn't willing to fix it, you can always fix it yourself. Why would you ever want to leave this decision to someone else?
Perhaps because I am not a software engineer, and I know that my mother barely knows how to poerate the mouse, let alone debug complex software.
The problem here, is that someone found a way to exploit a Microsoft Word Feature. Now we can tell them to do things in the name of security, oh wait, isn't that what we all complain Bush is doing?
A very famous man once said something along the lines of "They who would give up an essential liberty for temporary security, deserve neither liberty or security".
You are giving up features for temporary security. Anything Microsoft does will be a temporary fix. There are enough hackers out there that hate microsoft that no matter what, they will find a new way to exploit the software. Now before I hear any, "that's because microsoft sucks, use linux" comments, if all the people out there trying to find cracks and exploits for MS Software were instead going agains Linux, or other open sourced applications, you'd find just as many problems.
Don't believe me. Put up an appache web page on a linux box, or what ever opensourced so. Now have the only line on the page say "You can't hack this box". Get a link somewhere that people are going to see it, and then talk to me in a month as to how safe your page was.
Xaotik Designs
This horrible bug could even allow invaders to install malicious or undesirable software such as MS-Word 97.
Oh, wait
Table-ized A.I.
Of course, there's a way to address this problem with...a Word Macro! :)
Sub AutoOpen()
'
' IncludeTextBarrer Macro
' Macro created 9/13/2002 by Geoff Speare
' Created for Word 2000, use at own risk, etc.
'
Dim count As Integer
Dim vbFix As VbMsgBoxResult
Dim blFoundOne As Boolean
blFoundOne = False
For count = 1 To ActiveDocument.Fields.count
If ActiveDocument.Fields(count).Type = wdFieldIncludeText Then
blFoundOne = True
vbFix = MsgBox("An INCLUDETEXT field has been found. Would you like to lock it? " & _
"(Select All and then Ctrl-4 will unlock all fields if you change your mind.)", vbYesNo, "INCLUDETEXT Exploit Detection")
If vbFix = vbYes Then
ActiveDocument.Fields(count).Locked = True
End If
End If
Next
If blFoundOne Then
MsgBox "Your document may have a field which secretly includes text from another file. You may wish " & _
"to Reveal Field Codes (ALT-F9) and examine the document closely before saving or distributing it.", vbOKOnly, _
"INCLUDETEXT Exploit Detection"
End If
End Sub