Slashdot Log In
OpenOffice.org Security 'Insufficient'
Posted by
CmdrTaco
on Sun Aug 13, 2006 03:40 PM
from the taunting-crowds dept.
from the taunting-crowds dept.
InfoWorldMike writes "IDG News Service's Robert McMillan reports that researchers at French Ministry of Defense say vulnerabilities with open source office suite OpenOffice.org may rival those of Microsoft's version. With Microsoft's Office suite now being targeted by hackers, researchers at the French Ministry of Defense say users of the OpenOffice.org software may be at even greater risk from computer viruses. "The general security of OpenOffice is insufficient," the researchers wrote in a paper entitled In-depth analysis of the viral threats with OpenOffice.org documents. "This suite is up to now still vulnerable to many potential malware attacks," they wrote. The OpenOffice.org team has already fixed a software bug discovered by the researchers, and the two groups are in discussions about how to improve the overall security of the software. "The one real flaw in the programming logic has been fixed," said Louis Suarez-Potts, an OpenOffice.org community manager. "The others are theoretical.""
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
"theoretical" (Score:5, Insightful)
Re:"theoretical" (Score:5, Informative)
I can see where some of this gets dismissed as "theoretical" -- for instance, while OOo has such an API, this isn't any more secure or insecure than the fact that other applications, like MySQL, for instance, have a similarly flexible API. Ditto for Microsoft Office or any operating system.
The information on authentication certificates seems a little outdated -- OOo 2.0 supports digital signatures for documents and macros and even security settings that prevent macros from being run that are not signed. I think that as for a solid, verifiable security model, OOo 2.0 seems to have one based on digital signatures.
Parent
Re:"theoretical" (Score:5, Informative)
Then they go on to explain (still in powerpoint bullets) that they managed to write a macro that sends an e-mail with an attached file which then executed C code which modified dicOOo.
And they conclude that infection risk under OOo is MAXIMAL and its use should be discouraged for security reasons.
Parent
Re:"theoretical" (Score:5, Informative)
I'm replying to my own post but the other was the translation and this is what I think of it. I think it's bullshit.
Point number 10, what the fuck ? zip is just a comression format. Point number 11, trusted folders are defined by YOU. So most people don't even have them. But if it's convenient to you to define a folder where all macros are trusted how is it different from accepting every macro while you open the document ? It must be quite convenient for developers who want to test their macros. Most other points ? Way too vague to mean anything. Beside, if the danger for an office suite which isn't really attacked right now is "maximal", how should be classify MS Office ?
And their famous proof-of-concept... they won't even tell us how they got it to run. My guess is that they defined a trusted folder and put it in.
Until they reveal that, this document is worthless. Like that other proof-of-concept from I don't remember which AV vendor. Their macro (if you accepted it) would download a porn picture from the net and put it in the document. I guess it's much more dangerous than sending documents with the picture already in.
Parent
Re:"theoretical" (Score:3, Funny)
Re:"theoretical" (Score:4, Insightful)
Can intra-office communication not be done via RTF? Why do we need document formats that rival PDF and layout-software fileformats in complexity?
It seems like you could avoid all of this using a smaller array of utilities and custom scripts for office productivity, it just strikes me as impossible to create a scriptable, monolithic, document engine that won't have some sort of security hole on some platform. It seems like a cluster of smaller, more agile tools is the way to go.
Parent
Re:"theoretical" (Score:5, Interesting)
I worked for a little while for a (very large) organisation that made heavy use of scripting in Office. Every single type of document had an official corporate style. It had a (scripted) wizard that went through and added the sections you want, automatically filled in various bits of it, etc. After five minutes with the wizard you would have a multi-page skeleton document which would then just need text adding.
If I had been implementing the system from scratch, I would have made it intranet-based, with a TeX backend for generating PDFs, but they had an enormous amount invested in the it, and a team working on updating and fixing the templates. It was sometimes a problem ensuring that you had the right version installed (which is why I would go for a client-server model), but even that could probably be fixed by scripting (simply have the wizard check it was the latest version and fetch / install it if now).
Parent
Re:"theoretical" (Score:4, Insightful)
If I had been implementing the system from scratch, I would have made it intranet-based, with a TeX backend for generating PDFs
If I'd been building it, for use with OOo, I'd have given it a backend that generated the OpenDocument data without using any macros within the application. The great thing about having a fully documented, open format like OpenDocument is that you can easily generate and manipulate documents with any tool that's convenient.
Of course, the same is true of TeX, but if you generate OpenDocument format, then you can use OOo to edit and maintain it. In most environments the users are more likely to be comfortable with that than with TeX.
I think the openness of the format actually eliminates many of the reasons that macros are so important in the Microsoft Office world.
Parent
Re:"theoretical" (Score:3, Informative)
What generally happens is this (and I'd expect it to be much the same for most of Office's macro features):
Department A perceives a need for a complicated spreadsheet or a small database. It's not really complicated enough to go through the "pass it up the line and set up a project in conjunction
Re:"theoretical" (Score:3, Insightful)
Data and code are fundamentally linked. You can put an artificial barrier between them, but that doesn't do much if you lose functionality by doing so.
Let's say that I've got an Excel Sheet (I do) that needs to call a custom function that Excel doesn't ship with (I do, as well). While it would, in theory, be possible to move that code to a seperate macro in a "code" file somewhere, I'd still have to find a way to let anyone who opens my document get at th
Re:"theoretical" (Score:2)
Re:"theoretical" (Score:2)
""This suite is up to now still vulnerable to many potential malware attacks," they wrote. The OpenOffice.org team has already fixed a software bug discovered by the researchers, and the two groups are in discussions about how to improve the overall security of the software."
So the important issue was fixed and now they are discussing how to improve security overall, it sounds to me like they handled it perfectly.
Re:"theoretical" (Score:3, Informative)
Thats a cool thing with open source (Score:4, Insightful)
Re:Thats a cool thing with open source (Score:5, Insightful)
Parent
The problem with Open Office (Score:3, Informative)
... is that when they do have a security 'fix', they force you to update by downloading the entire suite... they don't have differential patches. I personally get sick and tired of having to download around 100 MBytes of app, uninstall the original, and re-install the new. Granted on my Linux box the package updater will do all three, but the updater takes forever to download the files. Quite frankly it is a pain in the ass. Sometimes I delay installing an update because of it (sometimes quite a while).
Re:Thats a cool thing with open source (Score:3, Informative)
Re:Thats a cool thing with open source (Score:3, Interesting)
"I welcome any example where it took 4 weeks for a fix for a main package."
Well offhand, here is one [sourceforge.net] opened 3 years ago which still hasn't been fixed, though it would be difficult to exploit. Basically what happens is that that a machine with trust level 4 (the default is 3, so again this would be difficult to exploit) to gain level 5 access (meaning they can run arbitrary commands on computer running the service. No, STAF/STAX is not as big as Linux (which is why I was talking about open source in gen
Re:Thats a cool thing with open source (Score:3, Interesting)
I'm sorry that you pu
Re:Thats a cool thing with open source (Score:3, Informative)
Perhaps a bit ironic that you mention BIND. It's been quite a while since there's been a big security problem in BIND, and is currently the driving force in the largest security update to the DNS protocol in, like, decades - DNSSEC.
Yes, the BIND sources w
Re:Thats a cool thing with open source (Score:3, Insightful)
The problem with Open Office is that someone could check the fix in tonight but you wouldn't necessarily see a 2.04 until whenever they felt like releasing it which could be months or more. So really it's irrelevant in that situation that you're dealing with
Re:Thats a cool thing with open source (Score:3, Insightful)
You forgot to add " but often breaks some other piece of software."
Re:Thats a cool thing with open source (Score:3, Informative)
Sun does about 80% of the work on OpenOffice.org. This is a significant majority, but I would hardly classify 20% a trivial. The second largest contributor is Novell. Since they have OpenOffice.org deployed on every single one of their employees machines, they do a lot of work fixing dogfood bugs.
Let me think... (Score:5, Funny)
Microsoft's Office Suite IS being attacked.
OpenOffice could, possibly, theorectically, be attacked.
Re:Let me think... (Score:2)
Many eyes at work. Sounds like a + not - (Score:5, Insightful)
The closed source model doesn't offer the same level of opportunity to find flaws. Even when people do find flaws in closed source products the publishers are as likely to bury the report, deny the flaw it exists or use DMCA to sue the people who disclose the problems.
Chalk this up as a win for the open source model... at least for large high visibility projects like Open Office.
Re:Many eyes at work. Sounds like a + not - (Score:2, Interesting)
This seems to be the call of the open source zealout, but it is not reality. 99% of the people using Open Office are users. The other 1% contain people that might have the ability to look at it, but may not have the time or patience.
I have been involved with many open source projects over the past couple of years and it usually ends up like this:
1) someone emails a bug
Re:Many eyes at work. Sounds like a + not - (Score:3, Insightful)
Re:Many eyes at work. Sounds like a + not - (Score:3, Insightful)
Right... as compared to closed source, where 0% have the capability of auditing the source code.
Of course, things aren't as black and white
The Bad News Is... (Score:5, Funny)
The Good News is that in the time it takes the suite to open and load an infected document the malicious hacker has been captured by the FBI, brought to trial, convicted, and a patch made available.
What makes them think MS Office isn't vulnerable? (Score:5, Insightful)
I fail to see how this is a black mark against OpenOffice.org.
Re:What makes them think MS Office isn't vulnerabl (Score:2, Insightful)
I don't either. But you know that if MS (or its shills) can make it appear so, they will.
The goal isn't to be better, it's to be good (Score:2, Insightful)
I fail to see how this is a black mark against OpenOffice.org
I don't think that's (neccessarily) the point. Whatever MS does about their Office security flaws does not really concern me any longer. There's almost nothing that could ever make me use MS Office again. But so what. The point isn't which suite is better, the point is: OpenOffice.org still has flaws, and those should be fixed. In this context the statement "The [other flaws] are theoretical" does not make me feel good. I want even theoretical
MMKay.. Interesting, but.. (Score:4, Informative)
OO.org is vulnerable (Score:4, Insightful)
leaked MS Expense Report (Score:5, Funny)
To: accounting@microsoft.com
Attached find my receipts for the recent meetings I had with the French Ministry of Defense:
First class plane ticket to Paris: 2100 USD
Swank hotel in Paris: 1800 USD
Dinner for 2 at a spiffy restaurant: 800 USD
Hookers and blow for MoD officials: 5000 USD
Business Justification For Expense: I believe that we will sell ONE MILLION copies of Office to the French MoD.
--Steve
PS If you get a bill from the hotel about a broken chair, it was like that when I got the room, so I don't think we should pay it. Bill said it would be OK.
Gentle Reminder About the Ministry (Score:5, Insightful)
It's very difficult to go from that environment back to the real world where security is measured by successfully implementing long passwords in a company.
Making the inductive(?) leap that OpenOffice.org is insecure is a really long leap of faith. Are there holes? Probably.
In many ways, this is good news because the open source application is being picked over with a fine tooth comb by a large ministry.
Bring it on!
The imporant news here (Score:4, Funny)
Re:The imporant news here (Score:5, Funny)
Parent
Insecure by association? (Score:5, Insightful)
OPDs and Latex (Score:2)
I always turn off any live macro support in OpenOffice.org and Microsoft Word, and hope that is good enough security. I also tend to open Word
A little off topic, but I have been blogging about this lately: whether I am writing up short project documents or working on a for-fun book project (Ruby AI Programming), I find that just using Latex is much more productive for me. One reason is just seeing r
Re:OPDs and Latex (Score:4, Informative)
Parent
CVE-2006-2198 (Score:5, Informative)
Re:CVE-2006-2198 (Score:5, Informative)
Parent
Microsoft or Sun? (Score:2)
Microsoft has a version of OpenOffice? Isn't OpenOffice's closed version StarOffice, which is owned by Sun, not MS?
The actual problem is DicOOo (Score:4, Informative)
Installation d'une fonction offensive C dans la macro DicOOo.
La fonction C est exécutée à l'installation de DicOOo.
"DicOOo" is an installer for dictionaries into OpenOffice. Unfortunately, it seems to have too much power, and can be replaced or induced to install other things. This is an add-on to OpenOffice, and apparently an unsafe one.
Maybe we need to take a step back... (Score:5, Interesting)
How about we stop writing word processors and spreadsheets that are capable of running code (other than its own)?
I remember back when I was big on a certain usenet news group, we had a discussion about an email virus. The claim was, when you opened the email (don't recall the name off hand), it would do all sorts of nasty things to your computer, and possibly to your girlfriend/wife/sister/etc. The entire thing was a hoax that preyed on ignorant computer users, and urged them to spread the word.
My argument at the time was basically that an email client could not, or should not execute the text within the email itself, and any client that did, shouldn't be used.
Now I use Outlook on a daily basis, and guess what?
So, let's take a step back to simpler, less efficient applications. Get rid of what causes the vulnerabilities in the first place.
Now where did this box come from?
H.
Alternatives (Score:4, Interesting)
Compared to OO.o, which anyone can fix, even the French government itself, but which does fix bugs quickly.
The only problem with open office is (Score:3, Funny)
Just Turn Macros Off (Score:3, Interesting)