Slashdot Mirror
How Do You Handle New MS Word Vulnerabilities?
chipperdog asks: "With yet another zero-day exploit of MS-Word document files, what are fellow system admins doing to protect themselves against these threats? I have been blocking all .doc and .dot at the mail and proxy servers until malware scanners have signatures to detect and block the malicious files. Of course, this caused a uproar with the users, as there were continuous calls like: 'When can I send and receive Word files again' and 'I can't get anything done if I can't send/receive Word files'. Any suggestion of sending documents in different formats (like rtf, html, txt, or pdf) results in even more creative user 'feedback'. Has anyone done anything creative in their handling of word files — like having qmail-scanner pipe all .doc attachments through something such as wv to convert them to a less exploitable format?"
It's amazing how, we've been fighting this uphill battle to get our users to use Open Office, and now all of the sudden, managers are calling us to make sure all of their users have it. :-) Some days, I like my job. :-)
But this is slashdot. A slashdoter who didn't build his own computer is like a Jedi who didn't build his own lightsaber!
I like the position my ISP's HR people take: "The posting said "No Word documents accepted.". The job's as a senior network engineer. It's going to require lots of detective work to troubleshoot obscure and arcane problems. If you can't figure out how to use Word's "Save As" to save in RTF or HTML, you are not qualified for the position. If you can't figure out that "No Word Documents accepted." means we won't be accepting Word documents, you aren't qualified for any position.".
At least one of the three recent Word exploits affects Word for Mac as well.
.doc and .dot files does little to no good for the most recent vulnerability. Windows is coded to open correctly formatted documents with unknown extensions with Word. So all I'd have to do to get around your filter is rename the document to: Exploit!.iamnotavir.us0 and if someone is silly enough to double-click it, they'll be subject to whatever maliciousness I can inflict on them.
.doc, and .dot will not detect all Word documents."
Also, to the original question:
Scanning
From the e-week article:
"Do not rely on file-name extension filtering. In most cases, Windows will call Word to open a document even if the document has an unknown file extension. For example, if document.qwer contains the correct file header information, Windows will open document.qwer with Word. Filtering for common extensions such as
Setup MIMEDefang to convert M$ word attachments to PDF using openoffice. .doc extension or a mimetype of application/msword go through this process. .pdf .pdf already exists, use that file.
Any attachments with a
Also to reduce the overhead, get the sha1sum for the word document, and save the pdf to
Before any documents are converted with openoffice, get the sha1sum. if a
This stills allows people to get the content, which is most of the time, all they want.
There is also a program called antiword that will convert ms word documents to text, PDF, or PostScript.
But openoffice does a better job.
I agree. While they haven't banned the sending of .doc files at my company with the recent vulnerabilites, they were blocked for a time a few months ago. In any case, it's often better for people to either A) put the document on a network drive and send a link to it or B) Upload it to a Sharepoint site.
The advantage is both scenarios is that instead of creating dozens of copies of the same file, everyone viewing it is seeing the same file, which is especially useful when discussing edits or modifications to the document. If someone really needs a personal copy because they don't have network drive access for some reason (i.e. travelling), then they can ask the sender to change the file extension and send it to them separately.
- Exchanging finished documents for reading. PDF is better:
- It can reproduce the results exactly.
- It doesn't include Word's "change tracking" information which can cause embarrassing leaks.
- It's a standard with many interoperable implementations.
- Exchanging in-progress documents for revision. At least for stuff limited to your company, a version control server (like Subversion with friendly TortoiseSVN clients) is better:
- Doesn't cause email storage to grow enormously. Instead, a server actually meant for this kind of thing stores only deltas. And only one copy of each document - on most mailservers, the disk space consumed by an attachment is proportional to the number of recipients.
- Lets you easily find the latest version of a document. ("Did he send me another copy after this? I'm not sure.")
- Lets you easily retrieve any previous version, see changes/authors/checkin comments. (I don't trust Word's built-in change tracking, and you shouldn't either. Its security model is flawed, and I don't think it's reliable to begin with.)
- Supports locking/unlocking documents to prevent conflicting changes.
- With some setup, supports diffing and merging office documents. You can maintain branches!
- Supports searching - where I work, we've plugged in swish-e for full-text searching over our documentation repository.
I wish my company would just block all