PowerPoint ZeroDay Vulnerability Exploited

whitehatlurker writes to mention a WashingtonPost.com article about another unpatched flaw with Microsoft Office. The bug, part of the PowerPoint software, has already been used in the wild, and may be connected to an industrial espionage case. From the article: "This undocumented flaw does not appear to have been addressed in any of the 13 security updates Microsoft shipped this week to mend a variety of problems in Office software. As Security Fix and others have noted, some of the work Microsoft has done in hardening the security of the Windows operating system has forced the bad guys to look for lower-hanging fruit in applications that run on top of Windows, so we may see more Office flaws under attack."

Comments

The more vulnerabilities the better?

[kcbrown]

...because more vulnerabilities will cause more people to consider switching to something like OpenOffice, right?

Yeah right. The vast majority of the people who stick with Office these days are people who won't switch unless the alternative is 100% in every way, shape, and form "compatible" with (which to them means exactly the same as) Office.

Must be nice to be Microsoft, where you don't have to give a shit about your customers...

Re:The more vulnerabilities the better?

[kripkenstein]

"[...] people [...] won't switch unless the alternative is 100% in every way, shape, and form 'compatible' with [...] Office"

Exactly. This is why we need to get these security vulnerabilities in MS Office to work in OpenOffice, ASAP. It's all about compatibility, baby.

Seriously, though, I don't agree with the quote. Of course people want compatibility. But they also want security. Using MS office is a tradeoff: more compatibility, less security. When the tradeoff gets less comfortable, rational people will reconsider their options.

Re:The more vulnerabilities the better?

[ozmanjusri]

Does that suggest that people will switch to OpenOffice rather tha Office 2007?

I'm running the beta of Office 2007 now, and there's no doubt that it's the biggest change to the Office interface since the switch from DOS. The new "ribbon" interface is a little easier of novices to do normal tasks with, but is a real hindrance to power users familiar with the '95-03 style Offices.

Anyone who's already productive with the older apps will find it easier to shift to OOo than to Office 2007. There's a few new tricks under the hood of the suite, but nothing compelling enough to pay the cost of the new version. In fact, Access coders are definitely going to want to look for alternatives. The new version is pitched much more at desktop experimenters, to the serious detriment of professional developers.

Do you really need MS Office?

[pieterh]

The question people need to ask is not, "why should I switch to OpenOffice", but "what is the killer feature in MS Office that I absolutely need?" Do you really need to be able to run Word on a PDA? Do you need a smooth integration between Office and Exchange? Perhaps, but it's worth reevaluating.

If the cost-benefit ratio is not strong enough to make the cost and insecurity worthwhile, abandon MS Office and use OOo. For most people it's a lot less painful than it sounds. I've even seen OOo spread like a fashion in some teams that were 100% Microsoft, as they discovered that OOo does actually work very nicely, and as they started using ODF as a standard in place of Microsoft's own formats. We did this a long time ago... we get a consistent set of tools on Windows and Linux, and documents that now conform to a global standard and which I know will still be readable in 20 years' time, whatever software or platform I'm using.

There are many alternative office suites and OOo has its flaws, mainly it's a bit slow, but it has a feature set that hits 100% of what we've used - for documents, spreadsheets, simple graphics, and presentations - for years. And I don't get the feeling, when I run it, that I'm running a code base that has hundreds of undocumented backdoors, caused deliberately, or accidentally.

Re:Do you really need MS Office?

[pieterh]

Yes, the problem of "send this document to random people" is a real issue.

However, since OpenOffice has had a "create PDF" feature for ages, and since it produces really elegant PDFs, this is a solved problem.

I much prefer sending PDFs to editable documents because it prevents random modifications. When people do have to collaborate on writing a document, they can install OOo without much effort, and it is easy to learn, despite not being MS Office.

I've seen many people learn to use OpenOffice and the suggestion that its interface is hard to use is untrue. I've literally given non-technical people (office admins, sales and marketing people) a Linux box with OpenOffice and said, "go for it", and they've produced documents and spreadsheets and presentations without asking anything after, "what printer do I use".

PDFs are the answer to distributing prepared documents. PDF or HTML works fine for presentations. And if you *really* need to send someone an MS-Office format document, you use the "Save as" function to create it.

And this model has let us use OO for 4-5 years in a world where almost all of our clients use MS-Office. It works.

Re:Do you really need MS Office?

[tdvaughan]

And I don't get the feeling, when I run it, that I'm running a code base that has hundreds of undocumented backdoors, caused deliberately, or accidentally.

I, too, have become so much safer since I turned off my antivirus software and instead relied on good old, tried-and-tested intuition to detect malicious software and vulnerabilities.

Re:Do you really need MS Office?

[killjoe]

"you've got machines with RAM to spare, "

If you have enough RAM for access you have enough ram for office.

"you're not going to need support,"

If you need support you can buy it from Sun. You may have heard about Sun. I think they are a pretty large company.

"you're not going to need the pre-written macro code which is everywhere for Office,"

Office by default will not let you execute macros. Most organizations turn off the macro execution as a group policy in AD. Having said that if you have willingly chosen to open up your desktop to macro exploits and have willingly chosen to lock yourself to a vendor then you can't switch. Vendor lock sucks for an organization though. From now on you are no longer allowed to use any non MS office software ever. Good for them, sucks for you.

"you don't need the excellent VBA IDE,"

See above. You can script OO in python though, much better then VBA as far as I am concerned. There are several python IDEs around too last I checked.

"you don't need the excellent documentation,"

Wait let me check my office manual to see if it's better then the OO manual. Ooops looks like I didn't get an office manual. Seriously... There is excellent OO documentation. There are also several books which are cheaper then office.

"you're not going to use the entire systems implemented in Office (Excel and Access systems are commonplace where I work, they're commercial and not in-house software)"

If you are buying commercial apps they can (and should) use the office developer toolkit to deliver you a runtime. If they are forcing you to buy office just to run their apps then you are getting screwed. Also see the above remark about vendor lock.

"you don't mind not being able to properly use the documents everyone outside your organisation will be using, and the documents your employees will be bringing from home,"

Keep a copy of office around for those rare documents that don't translate properly. Tell your employees to use OO at home if they want to work from home. All companies have document standards.

"you don't mind the GUI not matching the rest of your system,"

When office 2007 comes out the GUI of OO will more closely match your XP box then office will.

"you don't mind using a piece of software which no-one will have audited,"

What makes you think office was audited? Who audited that commercial software package you got from that commercial vendor (you know the one that requires office to run). Who audited that messenger program half of your staff is using? I have news for you. 100% of the corporations in the world are running at least one piece of un-audited software.

"you can't wait for Office 2007 for ODF,"

The ODF support in 2007 will be read only. It will also be crippled from the looks of it.

"and you don't need a rich macro API."

You have no idea what you are talking about. None at all. Every part of OO is scriptable.

"Disclaimer: I'm not an MS fanboy, "

Yes you are. If you weren't you would not have lied so much.

Re:My world is crumbling!

[Anonymous Coward]

No! A flaw in PowerPoint? A security issue? Say it ain't so!

Hastily written karma whoring frist prost on Slashdot? Say it ain't so!

Re:Office Vulnerabilities

[blowdart]

It depends how they update windows. If they've switched from windowsupdate to microsoftupdate then Office updates will be included (as well as updates for some server software like SQL 2005). The switch also changes the automatic update software.

"Office!" [Snorts]

[ettlz]

He he, "PowerPoint"! When will you people give up and use LaTeX/Beamer like everyone else?!