02.25.09

Gemini version available ♊︎

Confirmed: Microsoft OOXML a Security Hazard

Posted in Formats, Google, Microsoft, Open XML, OpenOffice, Security at 1:58 pm by Dr. Roy Schestowitz

flickr:2400867976

SEVERAL MONTHS ago we warned that OOXML is not secure. Its dependence on a particular platform and office suite rendered it insecure by design just like those ‘origin’ formats, namely binaries, which it merely shuffled around (reassembled).

It is now official and also confirmed that OOXML files are not just insecure but there are also persistent attacks against new flaws (without any security patches being available, i.e. zero-day). To quote one of the more recent reports:

Some Open XML based products as Microsoft Excel are affected by a security flaw and the Trojan.Mdropper.AC.

There is fairly wide coverage of this problem, e.g. in:

Microsoft’s Excel spreadsheet program has a 0-day vulnerability that attackers are exploiting on the Internet, according to security vendor Symantec.

A 0-day vulnerability is one that does not have a patch and is actively being used to attack computers when it is publicly revealed.

Heise Online calls this vulnerability “critical” (highest level of severity by another one Microsoft’s ‘standards’).

According to unconfirmed reports, the anti-virus manufacturer Symantec has found a trojan that seems to use a security hole in Microsoft Excel to remotely execute code on a user’s system. The attack is triggered by opening a maliciously crafted Excel file, causing an unspecified remote code-execution vulnerability.

One reader points out that “Microsoft is continuing its war against a universal office format.

“Notice in particular: ‘will be unable to open Office 2003 files or earlier versions in Office 2003 or 2007 Microsoft Office System

“What kind of hell is this causing in agencies, big businesses and schools? It’s not like they don’t have or could live with out the terabytes of electronic records now locked out by the kludge outlined above.”

Such problems could first be seen a year ago when Microsoft’s OOXML crimes were still prevalent. To make matters worse, Microsoft will continue to drift further away from ECMA OOXML, probably to gravitate in its own proprietary direction. Office 14, for example, is not committed to any real standards and according to yesterday’s report from Mary Jo Foley, it’s already delayed anyway.

Ballmer: Office 14 not this year

[...]

However, last year, more than a few times execs slipped up and indicated Office 14 would ship in 2009.

Things are not working well for Redmond these days. For real profit, Microsoft is highly dependent on Office which is its most profitable product (and one of the few that are actually profitable). Unless Microsoft can reinforce planned obsolescence and convince people to buy an upgrade they do not need, there’s great trouble ahead. The economic meltdown does not help.

OpenOffice.org makes a remarkably familiar substitute and Google Apps, among other SaaS alternatives, gain momentum despite the slew of disinformation from former Microsoft employees (masquerading as research firms).

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. IRC Proceedings: Tuesday, October 26, 2021

    IRC logs for Tuesday, October 26, 2021



  2. Beatriz Busaniche Speaks Up in Defense of Richard Stallman

    Beatriz Busaniche sent us this comment in July 2021. She wrote it originally in Spanish. Here are both the original text and our translation to English.



  3. Links 26/10/2021: SUSE Linux Enterprise Micro 5.1 and Multi-Distro Benchmarks

    Links for the day



  4. Links 26/10/2021: Vulkan 1.1 Conformance for Raspberry Pi 4 and Tor Browser 10.5.10

    Links for the day



  5. [Meme] Sounds Legit

    When not cheating on the wife, the EPO‘s “doyen” cheats in the exams and makes it into the epi Council, in effect working “[t]owards a common understanding [sic] of quality” with “patent attorneys nominated as “assessors” by the EPO, epi and BusinessEurope” (notorious lobbyists for dictators, litigation, and monopolies, neither business nor science)



  6. [Meme] Mayoral Patent Office Chief

    As it turns out, political 'double-dipping' isn't just a thing in North Macedonia, Austria, and EPOnia



  7. Romania's Patent Office (OSIM): Nine Different Chiefs in Just Eight Years

    The Romanian State Office for Inventions and Trademarks (OSIM), being the equivalent of the U.S. Patent and Trademark Office (USPTO) in the sense that it covers both patents and trademarks, is a very flaky institution with no shortage of scandals; for our English-reading audiences we now have a summary of a decade’s worth of blunders and leadership changes



  8. The EPO’s Overseer/Overseen Collusion — Part XXIV: The Balkan League - Romania

    Romania’s patent office has been in flux this past decade, occasionally led by people with no relevant experience, but rather political connections (like EPO President António Campinos) and sometimes forged documents and fake degrees



  9. IRC Proceedings: Monday, October 25, 2021

    IRC logs for Monday, October 25, 2021



  10. [Meme] “Social Democracy” at the EPO

    Some comments on the current situation at the European Patent Office from Goran Gerasimovski, the new EPO Administrative Council delegate for North Macedonia and Social Democratic candidate for mayor of Centar (a municipality of Skopje)



  11. [Meme] António Campinos Visits the OSIM

    António Campinos visits OSIM Director-General Ionel Muscalu in February 2014



  12. [Meme] [Teaser] Meet the President

    Later today we shall see what Romania did for Battistelli



  13. Links 26/10/2021: Latte Dock 0.10.3 and Linux 5.15 RC7

    Links for the day



  14. Gemini Protocol's Originator: “I Continue to Care About This Project and I Care About the Community That Has Formed Around It.”

    'Solderpunk' is back from a long hiatus; this bodes well for Geminispace, which grew fast in spite of the conspicuous absence



  15. Bulgarian Like Bavarian Serfdom

    Bulgarian politics seem to have played a big role in selecting chiefs and delegates who backed Benoît Battistelli‘s unlawful proposals, which treat workers almost like slaves and ordinary citizens as disposable ‘collaterals’



  16. The EPO’s Overseer/Overseen Collusion — Part XXIII: The Balkan League - Bulgaria

    Today we examine the role of Bulgaria in Benoît Battistelli‘s liberticidal regime at the EPO (as well as under António Campinos, from 2018 to present) with particular focus on political machinations



  17. Links 25/10/2021: New Slackware64-current and a Look at Ubuntu Budgie

    Links for the day



  18. Links 25/10/2021: pg_statement_rollback 1.3 and Lots of Patent Catchup

    Links for the day



  19. Microsoft GitHub Exposé — Part III — A Story of Plagiarism and Likely Securities Fraud

    Today we tread slowly and take another step ahead, revealing the nature of only some among many problems that GitHub and Microsoft are hiding from the general public (to the point of spiking media reports)



  20. [Meme] [Teaser] Oligarchs-Controlled Patent Offices With Media Connections That Cover Up Corruption

    As we shall see later today, the ‘underworld’ in Bulgaria played a role or pulled the strings of politically-appointed administrators who guarded Benoît Battistelli‘s liberticidal regime at the EPO



  21. IRC Proceedings: Sunday, October 24, 2021

    IRC logs for Sunday, October 24, 2021



  22. Links 25/10/2021: EasyOS 3.1 and Bareflank 3.0

    Links for the day



  23. The Demolition of the EPO Was Made Possible With Assistance From Countries That Barely Have European Patents

    The legal basis of today's EPO has been crushed; a lot of this was made possible by countries with barely any stakes in the outcome



  24. The EPO’s Overseer/Overseen Collusion — Part XXII: The Balkan League - North Macedonia and Albania

    We continue to look at Benoît Battistelli‘s enablers at the EPO



  25. Links 24/10/2021: GPS Daemon (GPSD) Bug and Lots of Openwashing

    Links for the day



  26. Links 24/10/2021: XWayland 21.1.3 and Ubuntu Linux 22.04 LTS Daily Build

    Links for the day



  27. IRC Proceedings: Saturday, October 23, 2021

    IRC logs for Saturday, October 23, 2021



  28. Links 24/10/2021: Ceph Boss Sage Weil Resigns and Many GPL Enforcement Stories

    Links for the day



  29. GAFAM-Funded NPR Reports That Facebook Let Millions of People Like Trump Flout the So-called Rules. Not Just “a Few”.

    Guest post by Ryan, reprinted with permission



  30. Some Memes About What Croatia Means to the European Patent Office

    Before we proceed to other countries in the region, let’s not forget or let’s immortalise the role played by Croatia in the EPO (memes are memorable)


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts