EditorsAbout the SiteComes vs. MicrosoftUsing This Web SiteSite ArchivesCredibility IndexOOXMLOpenDocumentPatentsNovellNews DigestSite NewsRSS

02.25.09

Confirmed: Microsoft OOXML a Security Hazard

Posted in Formats, Google, Microsoft, Open XML, OpenOffice, Security at 1:58 pm by Dr. Roy Schestowitz

flickr:2400867976

SEVERAL MONTHS ago we warned that OOXML is not secure. Its dependence on a particular platform and office suite rendered it insecure by design just like those ‘origin’ formats, namely binaries, which it merely shuffled around (reassembled).

It is now official and also confirmed that OOXML files are not just insecure but there are also persistent attacks against new flaws (without any security patches being available, i.e. zero-day). To quote one of the more recent reports:

Some Open XML based products as Microsoft Excel are affected by a security flaw and the Trojan.Mdropper.AC.

There is fairly wide coverage of this problem, e.g. in:

Microsoft’s Excel spreadsheet program has a 0-day vulnerability that attackers are exploiting on the Internet, according to security vendor Symantec.

A 0-day vulnerability is one that does not have a patch and is actively being used to attack computers when it is publicly revealed.

Heise Online calls this vulnerability “critical” (highest level of severity by another one Microsoft’s ‘standards’).

According to unconfirmed reports, the anti-virus manufacturer Symantec has found a trojan that seems to use a security hole in Microsoft Excel to remotely execute code on a user’s system. The attack is triggered by opening a maliciously crafted Excel file, causing an unspecified remote code-execution vulnerability.

One reader points out that “Microsoft is continuing its war against a universal office format.

“Notice in particular: ‘will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System

“What kind of hell is this causing in agencies, big businesses and schools? It’s not like they don’t have or could live with out the terabytes of electronic records now locked out by the kludge outlined above.”

Such problems could first be seen a year ago when Microsoft’s OOXML crimes were still prevalent. To make matters worse, Microsoft will continue to drift further away from ECMA OOXML, probably to gravitate in its own proprietary direction. Office 14, for example, is not committed to any real standards and according to yesterday’s report from Mary Jo Foley, it’s already delayed anyway.

Ballmer: Office 14 not this year

[...]

However, last year, more than a few times execs slipped up and indicated Office 14 would ship in 2009.

Things are not working well for Redmond these days. For real profit, Microsoft is highly dependent on Office which is its most profitable product (and one of the few that are actually profitable). Unless Microsoft can reinforce planned obsolescence and convince people to buy an upgrade they do not need, there’s great trouble ahead. The economic meltdown does not help.

OpenOffice.org makes a remarkably familiar substitute and Google Apps, among other SaaS alternatives, gain momentum despite the slew of disinformation from former Microsoft employees (masquerading as research firms).

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Digg
  • del.icio.us
  • Reddit
  • co.mments
  • DZone
  • email
  • Google Bookmarks
  • LinkedIn
  • NewsVine
  • Print
  • Technorati
  • TwitThis
  • Facebook

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New


  1. With UPC Dead for Battistelli's Entire Remaining Term, No Reason for the EPO or the Administrative Council to Keep Battistelli Around

    Thoughts about what happens to the EPO's leadership after 'Brexit' (British exit from the EU), which severely undermines Battistelli's biggest project that he habitually used to justify his incredible abuses



  2. Links 24/6/2016: Xen Project 4.7, Cinnamon 3.0.6

    Links for the day



  3. Benoît Battistelli Should Resign in Light of New Leak of Decision in His Vendetta Against Truth-Telling Judge (Updated)

    Benoît Battistelli continues to break the EPO's own rules, not just national laws, as a new decision helps reveal



  4. Fake Patents on Software From Fake Australian 'Inventor' of Bitcoin and the Globally-Contagious Nature of EPO Patent Scope

    News from Australia regarding software patents that should not be granted and how patent lawyers from Australia rely on European patent law (EPO and UK-IPO) for guidance on patent scope



  5. Patent Lawyers Love (and Amplify) Halo and Enfish, Omit or Dismiss Cuozzo and Alice

    By misinterpreting the current situation with respect to software patents and misusing terms like "innovation" patent lawyers and others in the patent microcosm hope to convince the public (or potential clients) that nothing in effect has changed and software patents are all fine and dandy



  6. Looks Increasingly Plausible That Battistelli is Covering up Bogus and/or Illegally-Obtained 'Evidence' From the EPO's Investigative Unit

    Why we believe that Benoît Battistelli is growingly desperate to hide evidence of rogue evidence-collecting operations which eventually landed himself -- not the accused -- in a catastrophic situation that can force his resignation



  7. As Decision on the UK's EU Status Looms, EPO Deep in a Crisis of Patent Quality

    Chaotic situation at the EPO and potential changes in the UK cause a great deal of debate about the UPC, which threatens to put the whole or Europe at the mercy of patent trolls from abroad



  8. Another Demonstration by European Patent Office (EPO) Staff on Same Day as Administrative Council's Meeting

    SUEPO (staff union of the EPO) continues to organise staff actions against extraordinary injustice by Benoît Battistelli and his flunkies whom he gave top positions at the EPO



  9. Links 23/6/2016: Red Hat Results, Randa Stories

    Links for the day



  10. Interview With FOSSForce/All Things Free Tech

    New interview with Robin "Roblimo" Miller on behalf of FOSSForce



  11. Links 22/6/2016: PulseAudio 9.0, GNOME 3.21.3 Released

    Links for the day



  12. IP Europe's UPC Lobbying and the EPO Connection

    The loose but seemingly ever-growing connections between AstroTurfing groups like IP Europe (pretending to represent SMEs) and EPO staff which is lobbying-centric



  13. EPO “Recruitment of Brits is Down by 80%”

    Letter says that “recruitment of Brits is down by 80%” and "the EPO lost 7% of UK staff in one year"



  14. The Conspiracy of Patent Lawyers for UPC and Battistelli's Role in Preparing by Firing People

    The parasitic firms that lobby for the UPC and actually create it -- firms like those that pass money to Battistelli's EPO -- are doing exactly the opposite of what Europe needs



  15. Patent Lawyers, Having Lost Much of the Battle for Software Patents in the US, Resort to Harmful Measures and Spin

    A quick glance at how patent lawyers and their lobbyists/advocates have reacted to the latest decision from the US Supreme Court (Justice Breyer)



  16. Links 21/6/2016: Fedora 24 and Point Linux MATE 3.2 Officially Released

    Links for the day



  17. Supreme Court on Cuozzo v Lee Another Major Loss for Software Patents in the United States

    Much-anticipated decision on the Cuozzo v Lee case (at the highest possible level) serves to defend the appeal boards which are eliminating software patents by the thousands



  18. As Alice Turns Two, Bilski Blog Says 36,000 (Software) Patent Applications Have Been Rejected Thanks to It

    A look back at the legacy of Alice v CLS Bank and how it contributed to the demise of software patents in the United States, the birthplace of software patents



  19. EPO Self-Censorship by IP Kat or Just Censorship of Opinions That IP Kat Does Not Share/Accept (Updated)

    ree speech when it's needed the most (EPO scandals) needs to be respected; or why IP Kat shoots itself in the foot and helps the EPO's management by 'sanitising' comments



  20. Caricature: Bygmalion Patent Office

    The latest cartoon regarding Battistelli's European Patent Office



  21. Links 21/6/2016: GNU/Linux in China's HPC, Linux 4.7 RC4

    Links for the day



  22. Under Battistelli's Regime the EPO is a Lawless, Dark Place

    How the EPO's Investigative Unit (IU) and Control Risks Group (CRG), which is connected to the Stasi through Desa, made the EPO virtually indistinguishable from East Germany (coat of arms/emblem above)



  23. New Paper Demonstrates That Unitary Patent (UPC) is Little More Than a Conspiracy of Patent 'Professionals' and Their Self Interest

    Dr. Ingve Björn Stjerna's latest paper explains that the UPC “expert teams” are in fact not experts but people who are using the UPC as a Trojan horse by which to promote their business interests and corporate objectives



  24. Money Flying to Private Companies Without Tenders at Battistelli's EPO (by the Tens of Millions!)

    Extravagant and cushy contracts to the tune of tens of millions of Euros are being issued without public scrutiny and without opportunities to competition (few corporations easily score cushy EPO contracts while illusion of tendering persists -- for small jobs only)



  25. Patent Examiners and Insiders Acknowledge Profound Demise in Patent Quality Under Battistelli

    By lowering the quality of patents granted by the European Patent Office Battistelli hopes to create an illusion of success, where success is not measured properly and is assessed by biased firms which he finances



  26. Jericho Systems Threatens Alice, Court of Appeals for the Federal Circuit Threatens the Patent Trial and Appeal (PTAB)

    A look at the two latest threats to those who helped put an end to a lot of (if not most) software patents in the US



  27. How the Halo Electronics Case Helps Patent Trolls and How Publications Funded by Patent Trolls (IAM for Instance) Covered This

    A Supreme Court ruling on patents, its implications for software patent trolls, and how media that is promoting software patents and patent trolls covered it



  28. Patent Lawyers' Fantasy Land Where Software Patents Are Suddenly Resurrected Even When They're Not

    A quick glance at where the debate over software patents in the United States stands and how profiteers (such as patent lawyers) not only mislead the public but also bully the messengers



  29. Links 19/6/2016: Randa Over, Fedora 24 Release Soon

    Links for the day



  30. [ES] La Oficina Europea de Patentes de Battistelli Amplia su Contrato con el Nefasto FTI Consulting Para Neutralizar a los Medios, Desperdicia Millones de Euros

    Sacando a luz a lo que pasa con el presupuésto de la EPO y como es puesto “a trabajar” bajo la tiranía sin precedente de Battistelli (Eponia) justo en el corazón de Europa


CoPilotCo

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

CoPilotCo

Recent Posts