Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security

Microsoft Word Security Flaw 529

Posted by timothy from the remember-word-viruses-fondly dept.
JWL-23 writes: "cnn.com is reporting that a Microsoft Word flaw may allow file theft. Furthermore, they plan on not fixing Word 97, leaving millions of users out in the cold. Yet another reason to try OpenOffice.org." It still takes more than running Word to expose the contents of your hard drive though.
This discussion has been archived. No new comments can be posted.

Microsoft Word Security Flaw More

Microsoft Word Security Flaw

Comments Filter:

  • Incidentally (Score:5, Interesting)

    by sheriff_p ( 138609 ) on Friday September 13, 2002 @01:20PM (#4252043)
    Incidentally, Virus Bulletin [virusbtn.com] are today running a piece about the first ever MS Office worm Winword.Concept [virusbtn.com].

    Isn't it sad when security flaws make you all nostalgic...

  • Why should they fix it? (Score:3, Insightful)

    by www.sorehands.com ( 142825 ) on Friday September 13, 2002 @01:21PM (#4252050) Homepage
    They have no obligation since they have their license that says, "we are not responsible for anything, even if we put it there intentionally."


    Microsoft may come up with a patch for it. All you will have to do is call their 900 number and sit on hold for 20 minutes.

  • OpenOffice... (Score:3, Interesting)

    by carl67lp ( 465321 ) on Friday September 13, 2002 @01:21PM (#4252053) Journal
    I've been using OpenOffice for about a week now. So far, it's been quite nice, converting and importing all the Word files that I've thrown at it.

    I had a couple of mishaps with it that were due to odd Word markup, I suspect, but overall it's been a pleasant experience.

    Security flaws such as this drive me closer and closer to completely abandoning MS Office in any fashion.

  • security (Score:5, Funny)

    by elindauer ( 520825 ) <eric@lindauer.hcmny@com> on Friday September 13, 2002 @01:21PM (#4252056) Homepage
    What do you want them to do? Start architecting their software for security?

    • Re:security (Score:3, Interesting)

      by Huge Pi Removal ( 188591 )
      Exactly. The whole Microsoft concept is to make things easier for users without worrying about the consequences. Which of course, in the end, doesn't make things easier for users, but then they're short-sighted.

      It's almost as if MS was staffed entirely by PHBs...
    • Wasn't that the idea behind "Trusted Computing" and the "bug-fix February"? Or does "Trusted Computing" mean <SLEDGE-HAMMER>"Trust us, we know what we're doing!"</SLEDGE-HAMMER>

    • Makes me think of the ZDNet interview with Jim Allchin [com.com] the other day.

      Q: ... What's at the top of your agenda these days?
      A: Quality is at the very top: Excellence in design, architecture and relationship to customers is very important...

      I guess he didn't get the BillG memo that security should have been listed somewhere in there. Ah, but we shouldn't expect every employee to have gotten that memo.

      Theoretically, we could assume he meant security as part of design and architecture, but we've been given very little proof the Microsoft includes it in those points.

      of course I won't believe it's a top concern until I see Mr MonkeyBoy on stage clapping out and changing "Security, security, security security..."

    • Sorry for the off-topic post, but I think there's an important point lurking in this issue. Aha! You get part of the architecture installed in the hardware and then the software company not only gets a new revenue stream (by providing new software) but also gets an instant scapegoat. Perfect.

      Here I'm thinking (admittedly naively) about "digital rights management". Question is, what level of confidence/assurance/responsibility of security do companies like Microsoft, Oracle, Intel, etc., provide? Do the RIAA/MPAA (even the US gubbmint) have enough confidence in these companies to "do things right"? There is sufficient evidence out there to avoid a certain OS vendor to provide secure solutions.

  • YOU LOOK LIKE YOU'RE STEALING A FILE! (Score:5, Funny)

    by kvn299 ( 472563 ) on Friday September 13, 2002 @01:22PM (#4252064)
    Would you like some assistance?

  • ZDNet's take on this story (Score:5, Informative)

    by buzzdecafe ( 583889 ) on Friday September 13, 2002 @01:23PM (#4252068)
    ZDNet has this story here:
    http://zdnet.com.com/2100-1104-957786.html
  • and that word is...? Competitive?

  • Open Office (Score:3, Insightful)

    by cdf12345 ( 412812 ) on Friday September 13, 2002 @01:24PM (#4252083) Homepage Journal
    Thank god I downloaded openoffice last night.

    My sister's entire school district is switching to it, it's cheap and open source, so theres no "were not going to fix it" crap.

    Schools have been sold on the idea that students need to learn the microsoft products for the business world. But I say if you learn open office you'll be able to use office 2000 should an employer some day down the road still be using it.
    • ...should an employer some day down the road still be using it

      You sound quite young and naive. Companies in the past, today and tomorrow are not going abandon productivity suites such as MSOffice because of these vulnerabilities/exploits. The reason why the majority of schools teach proficiencies in these products is that the majority of businesses *use* them.

      I used to be a zealot as well. A few years of working every day has turned me into a realist.

      Thank god I downloaded openoffice last night.
      Phew, that was a close one!
      • All it takes is a Network Admin to switch over to a non standard software package and a few weeks for people to get used to it.

        Believe me, when our school realised they would save over $9000, the switch was a no brainer.

        All it takes is for some exposure, and some businesses looking at their savings, and people will not care if there software is Microsoft or not, especially with their "Trustworthy computing" campaign.

  • " If an attacker can persuade a target to open, modify and then return a document to him he can snaffle sensitive files on a user's PC. "

    This isn't a huge bug with office it's a huge bug with USERS.

    • Re:Social Engineering (Score:3, Insightful)

      by joshki ( 152061 )
      How? This isn't social engineering -- it happens in the real world all the time!

      I receive documents for review and editing from up to 400 different people -- and I'm not even all that high up the food chain. This would easily work on me -- and I'm very security concious. This isn't like "don't click on attachments from people you don't know" -- it falls more into the category of "don't ever use word and outlook and office for what they're designed to do." (I know -- use OO... When somebody convinces the government to do that...)

    • I work for a large law firm that shall remain anonymous. Much of our user population is still using Word 97, and for various reasons I don't agree with, secretaries are actually being trained to use macro based templates to perform relatively simple functions, so everybody has macros turned on. (Don't blame me, I'm a lawyer, not IT. Our IT department sucks like a vacuum, mainly because of a few powerful old farts who miss their quill pens, hate computers, and won't retire.)

      But back to my original point - there are many contexts where it is literally day-to-day routine for lawyers to email Word documents back and forth, with each recipient detaching and saving the file, throwing in a few edits, and sending it back. In some situations, such as court documents that typically are negotiated, then filed jointly (e.g., proposed pretrial and scheduling orders), this interaction occurs among parties who are adversaries in a lawsuit - the farthest thing I can imagine from a trusted exchange.

      This alone allows substantial opportunity for exploitation. Even if you don't know any specific filenames, it seems as though you could easily grab the Registry, which is always named the same thing, and learn at least some path and filename information from it. And also keep in mind that many firms (not ours, fortunately) use a stupid auto-format that appends the path and filename into the footer of a document. Let's say I was an unscrupulous lawyer co-drafting a scheduling order, and knew about this exploit. I might go through the earlier files and records in the case, and look at the briefs my opponent filed. If the filename was in the footer, I could rig the scheduling order to get the brief, which would contain not only the printed text I'd already seen when the brief was filed, but perhaps leftover redlines, comments, those mysterious fragments at the bottom, etc.

      To answer your obvious questions: (1) no, I haven't tried it, and I'm not planning to, so I don't know if it would actually work, and (2) I have sent the Bugtraq link to the one non-worthless person in our IT department, and (3) yes, I realize this is not a macro exploit technically, so turning macros off won't help. But folks, this is really scary, and I am sure that legal practice is not the only line of business where "enemies" or untrusted parties exchange Word documents via email. That is how the world does business these days.

  • Faith in Microsoft? (Score:4, Funny)

    by soboroff ( 91667 ) on Friday September 13, 2002 @01:25PM (#4252089)
    I loved this one:

    "It's incredible to me that Microsoft would turn its back on Word 97 users," said Woody Leonhard, who has written books on Microsoft's Word and Office software. "They bought the package with full faith in Microsoft and its ability to protect them from this kind of exploit."


    To paraphrase Douglas Adams, "Bill says, 'I refuse to fix bugs, for patches deny faith, and without faith I am nothing.' "
    • To paraphrase Douglas Adams, "Bill says, 'I refuse to fix bugs, for patches deny faith, and without faith I am nothing.' "


      If only Bill could disappear in a puff of logic.

  • isn't it odd (Score:3, Interesting)

    by bashbrotha ( 41617 ) <todd.toddg@net> on Friday September 13, 2002 @01:26PM (#4252095) Homepage
    that qualcomm (maker of the eudora PIM/email client) was the company that found the bug? not that I like microsoft, but somehow this was a sneaky way to undermine microsoft by releasing to the public such a huge bug.

    I just wonder... did qualcomm try to blackmail microsoft first, before releasing the "scoop" on the bug?

    • Re:isn't it odd (Score:2, Insightful)

      by Photon Ghoul ( 14932 )
      First of all making bugs/exploits/whatever known to the public is a perfectly acceptable way of getting the information out to those who protect systems and those who need to protect themselves.

      Secondly... are you just grabbing conspiracy theories out of thin air? Where did you even come up with this? I would like to know.

    • Re:isn't it odd (Score:2, Interesting)

      by crm114 ( 586020 )
      Far more likely that macrotheft knew all along about this bug (or was it a feature?) and is using this opportunity to 'patch' in something that will render openoffice inoperable.

    • Re:isn't it odd (Score:3, Insightful)

      by _|()|\| ( 159991 )
      this was a sneaky way to undermine microsoft by releasing to the public such a huge bug.

      You're confused: Microsoft released the bug. Qualcomm just did a little free QA.

  • "That decision -- still left largely up in the air by Microsoft engineers -- may leave millions of users of Word 97 without a fix. All versions of Word are susceptible to the flaw, but the problem is most severe in Word 97."

    Up in the air. May. Key words and phrases that denote that no final decision to "screw" users of '97 have been made.

    Of course, 'bugged' documents could easily be captured by any number of third party virus scanning suites, which I would surely hope any use in an office environment who opens e-mails with reckless abandon would use.
  • finally, word is catching up to emacs 1988! [geek-girl.com]

  • MS-Word and document exchange (Score:5, Informative)

    by Charles Dodgeson ( 248492 ) <jeffrey@goldmark.org> on Friday September 13, 2002 @01:33PM (#4252157) Homepage Journal
    Yet another reason why MS Word is not a document exchange format [goldmark.org]. That rant is also avaible in other formats [goldmark.org]

  • Old software is a risk? (Score:4, Insightful)

    by m_chan ( 95943 ) on Friday September 13, 2002 @01:34PM (#4252161) Homepage
    Analyst Laura DiDio of the Yankee Group said companies are taking a risk by using such old software, but Microsoft should correct the problem because of its severity.

    I am having a hard time getting my head around the concept that newer software equals software with "less risk". I do not understand why a product, open or closed, is inherently more "risky" due to its age. Perhaps she means un-patched old software? Is she advising users of a genuine risk, or is she making the case for a revenue stream and saying that IS Managers who do not stay "less old" in their application selections are jeopardizing their companies? Although she admonishes Microsoft to fix the problem, it seems her implication is that said managers are negligent, as opposed to the software vendor who may or may not patch the hole they wrote.
    • I am having a hard time getting my head around the concept that newer software equals software with "less risk".

      You're not the only one. One of the main reasons why Office 97 is still in use is because of how long it has been around to prove itself. I know my company tests software fairly extensively before making any mandatory desktop upgrades - Office 97 is still the standard here, and Windows 2000 wasn't installed across the company until last fall. When productivity (money) is at stake, most companies will not risk switching to unproven software, and many might choose not to switch at all if the existing solution works. It is especially true with Windows that any significant change could result in serious problems, no matter how much testing has been done. Multiply that by thousands of employees, and that's some serious IT overtime, er, I mean decreased productivity.

    • I think the general thinking behind statements like this are the same reason Redhat 7.2 is more secure than say Redhat 3.0. The software has been around longer, so more security holes have been found and exploited. Granted, there are patches available but in general you could say that the newer versions are more secure with respect to these known exploits, since the patches are already built-in to the newer release.

  • Not True (Score:5, Informative)

    by DaytonCIM ( 100144 ) on Friday September 13, 2002 @01:37PM (#4252179) Homepage Journal
    "Furthermore, they plan on not fixing Word 97, leaving millions of users out in the cold."

    That's not entirely true. It is true that before this story broke, Microsoft had no plans on updating or offering any new fixes for anything '97.
    However, CNN and AP reported this morning that Micorsoft hasn't ruled out a fix and that they are in the process of determining what it would take to make a fix available.

  • hidden codes (Score:2, Insightful)

    by ndevice ( 304743 )
    quote from the article:

    "Microsoft suggests users view hidden codes in every document they open"

    Most people I know don't even like looking at non-printable characters...

    While they're at it, they may as well suggest that everyone examine binaries manually before they run them.

  • It's not suprising (Score:2, Insightful)

    by Kakarat ( 595386 )
    However from a business point of view, it's not effective to keep patching very old code for something that is fixed (or will be) in a newer version of code. Also, they want to give users a reason to get off their old software and have them pay more money to upgrade.

  • file sharing (Score:3, Funny)

    by RGRistroph ( 86936 ) <rgristroph@gmail.com> on Friday September 13, 2002 @01:43PM (#4252231) Homepage
    Is there any way we can make a filesharing protocol based on this, and have gateway machines that mirror files that are behind facist firewalls that block gnutella ports to gnutella ? A kind of really long latency email server ?
  • From the article:
    Microsoft suggests users view hidden codes in every document they open. In Word 2002, the latest version, that can be done by selecting tools, options, then checking the "field codes" box.
    Fucking Jesus. The only justification for paying hundreds of dollars a year to a software behemoth is the expectation that your software is secure and usable. What they're admitting is that their software is so insecure that you have to become an expert in (what are for most people) arcane configuration options just to make sure your software doesn't bite you in the ass.

    Satirizing this stuff is almost obsolete. Your word processor can send confidential files without you knowing it? What's next, your email client and movie player? Oh ... wait ...

    See? That's hardly even funny anymore - people expect it. Timothy's right, though - the rubber meets the road with the IT manager. When users come to you asking for an office suite for home, play up what a nightmare Microsoft malware is, and how easy and free OS software is. People are starting to get this, and OS software is going to empower them.

    • Re:Ridiculous (Score:5, Insightful)

      by stratjakt ( 596332 ) on Friday September 13, 2002 @01:55PM (#4252332) Journal
      "play up what a nightmare Microsoft malware is, and how easy and free OS software is"

      No, I'd say use your head and give some insightful advice, rather than spout off like a ranting zealot. Don't "play up" anything. Give the truth.

      Don't lie about how easy it is to install and configure the OSS equivalents. Don't pretend they're going to be 100% compatible. And in gods name, stop with the "microsoft owns your soul" rants. Once that user realises you lied, there goes your credibility, your 'stroke'. Next time they'll ask for advice from the kid at the counter of the local Office Depot.

      If OSS is going to 'empower' people, it won't be through a bunch of FUD and politics. Let it sink or swim on its own virtues.

      This isn't a message directed at you, but rather to all who want to actually help open source be taken seriously.

  • Hey, new feature in Word!

  • 10 years (Score:2, Insightful)

    by thunderbug ( 51999 )
    The auto industry is required to make parts available for 10 years past the model year. Makes sense.

    Why not apply the same rule to software security fixes? Sure would do a lot to motivate better design.

    • The auto industry is required to make parts available for 10 years past the model year. Makes sense.
      Why not apply the same rule to software security fixes? Sure would do a lot to motivate better design.

      Because software isn't really regulated. Think about it...can you build your own "open-source" automobile and operate it on public highways without it being approved by the Department of Transportation? I'm not sure, but I'm guessing you can't.

      If the software industry is forced to make "security fixes" available for 10 years after initial release, then there will have to be some kind of authority that approves software packages (which of course would cost money) such that a company is legally responsible. Then there would be even less incentive for businesses to use open-source packages because their closed-source competitors have to legally provide 10 years worth of security fixes.

  • Some clarification (Score:5, Informative)

    by agantman ( 534201 ) on Friday September 13, 2002 @01:49PM (#4252284)
    1) IMHO the emphasis on Word97 is wrong. I originally tested this on Word2000 and it worked perfectly.

    2) I was not out to find yet another M$ bug. I was using Word for my daily work when I stumbled onto this. It was one of those "I wonder what this button does" things.

    3) The vulnerability is actually a lot more serious than the AP and bugtraq posts reveal. There is actually a way to skip the last step where the victim returns the bugged file. In other words, just editing and saving (or printing) the bugged file is sufficient. Look for a new bugtraq post early next week.
  • ...why not just ask them to send you their addressbook or whatever?

    If people are going to be doing this to documents from people they don't know, I don't how they're going to be smart enough to figure out that joe12345@hotmail.com isn't actually their tech support guy/marketing person/whatever who needs this file for some real reason?
    • I don't know about that. I've just been watching a documentary about building aircraft. They were talking about how the design and prduction of modern aircraft involves the work of hundreds if not thousands of companies. Suppose you're cooperating with some other company on supplying materials for an aircraft being built by a third company. It's not beyond the bounds of possibility that your partner in this part of the contract might be a competitor in another part of the same contract (or in other contracts). And I'm sure some organizations exchange MS Word documents by email, with both recipient and sender alternately making edits. I think this stinks, actually. This is pretty serious for contracting companies that use MS Word documents cooperatively. I'm not suggesting that there are organizations out there that are going to lose millions because of this flaw. But even the most perfunctory security audit must address holes like this. Unfortunately, I expect many organizations will just upgrade to a later version of Word.

  • I realize that Joe User wouldn't notice half the time, but when a document jumps in size you'd think they would wonder about that.
    That and the fact that most people don't delete their old mail.
  • what if I have mp3's on my hard drive?

    maybe we can get the riaa involved and sick them on M$ since its M$ that is causing the 'file sharing' violation (ie, if some user 'shares' files via Word that weren't for public consumption).

    wouldn't that be schweet to get M$ in trouble with the riaa. I'd buy a ticket to THAT event!

  • New backdoor policy. (Score:4, Interesting)

    by supabeast! ( 84658 ) on Friday September 13, 2002 @01:54PM (#4252323)
    I'm not making any accusations *cough*, but does this strike anyone else as a great addition to Microsoft's "fuck them over and make them upgrade" business model? Leave a product full of security flaws, and, years later, when people aren't upgrading to the new version, refuse to fix security flaws in the old versions.

    Refer to:
    http://news.com.com/2100-1001-273276.html
    ht tp://news.com.com/2100-1001-253578.html?legacy=c net
  • From the article: Microsoft suggests users view hidden codes in every document they open.

    Uh huh. Like that's going to happen.

    I imagine next month they're going to suggest that everyone view the source for web pages they visit to get around the latest IE bug.

  • Is this a macro virus? (Score:3, Funny)

    by smittyoneeach ( 243267 ) on Friday September 13, 2002 @01:59PM (#4252361) Homepage Journal
    Turning on Tools | Options | General | Macro virus protection ought to help. Yes, I looked at the Word97 menu to validate that...
    It strikes me that I know enough VBA that I could probably write some horrific trojan .doc's, lacked I all self respect.
    While no great supporter of his Majesty Satanic, this article seems rather a stretch of the /. motto 'News for nerds, stuff that matters'. It's not news, for nerds, nor does it matter.
    Come to think of it, such a stunt is likely also possible in Word Basic under Lose3.1, for the 286 diehards out there. Shall we also excoriate Redmond for failing to skin dive in that septic tank of code? Some old bastard in Scotsdale, AZ might be writing his memoir using that application, you know...

  • A Poorly-Written Article (Score:3, Funny)

    by guttentag ( 313541 ) on Friday September 13, 2002 @02:00PM (#4252368) Journal
    Microsoft's flagship word processor has for years had a security flaw that could allow a criminal to steal computer files by "bugging" a document with a hidden code.
    Oh good. My secrets are safe because I don't know any criminals. The only people after my documents are ambitious marketing managers, who may be similar to criminals, but are not.
    The company said it will definitely repair the problem only for owners of the most recent versions of the software. That decision -- still left largely up in the air by Microsoft engineers -- may leave millions of users of Word 97 without a fix.
    So are they "definitely" fixing it for owners of the most recent versions, or is it "up in the air?" Paging Copy Editor, aisle six. Cleanup in aisle six.

    Incidentally, Microsoft isn't "leaving millions of users of Word 97 without a fix." The fix is to upgrade your five-year-old copy of Word, get all the "great" features Microsoft has included since 97, and put money into Microsoft's coffers so they can develop great new features for Word 2007. Of course, that's Microsoft's solution. The better solution is to wipe your hard disk and download the Red Hat ISO or buy a Mac before you become further entangled in Microsoft's web.

    "They bought the package with full faith in Microsoft and its ability to protect them from this kind of exploit."
    If they were that gullible, this is the least worrisome of their problems.
    Analyst Laura DiDio of the Yankee Group said companies are taking a risk by using such old software...
    FUD in an AP article? I am shocked!
    Microsoft suggests users view hidden codes in every document they open.
    I hope that's not the fix. "Ford suggests drivers check their oil and tire pressure before each time they start their cars."

  • WORD (Score:2)

    by Rupert ( 28001 )
    Weapon Of Random Destruction
  • Microsoft suggests users view hidden codes in every document they open. In Word 2002, the latest version, that can be done by selecting tools, options, then checking the "field codes" box. Many companies, however, use such codes for legitimate and harmless purposes.
    In unrelated news, beef processors are asking all their customers to check their products for bacteria before eating. Just take a sample down to a local lab to be tested, and wait four to six weeks. The beef processors aren't responsible for meat going bad while waiting for test results.

    Microsoft. What insecurity to you want to exploit tomorrow?
  • It still takes more than running Word to expose the contents of your hard drive though.

    The article mentions that the reason this is an issue is because the manner in which files would be stolen follow a normal business process among corportate types... Receiving an email from a company member. Editing it (for markup or review), then sending an email to someone else. Secretaries are good candidates for generic attacks, since they'd often need to review documents. But even executives are prone to such unattentative activity.

  • this is insane (Score:3, Interesting)

    by deander2 ( 26173 ) <public@nOSPaM.kered.org> on Friday September 13, 2002 @02:10PM (#4252427) Homepage

    "Analyst Laura DiDio of the Yankee Group said companies are taking a risk by using such old software..."
    Insane. You know, if Isuzu discovered a fatal flaw in all Rodeos going back through 1997 yet announced they were only going to provide fixes for models '00, '01 and '02 there would be a congressional investigation.

    Completely insane.

  • This is what makes me not use M$. (Score:5, Insightful)

    by xanadu-xtroot.com ( 450073 ) <xanaduNO@SPAMinorbit.com> on Friday September 13, 2002 @02:10PM (#4252429) Homepage Journal
    FTA:

    But, referring to Microsoft engineers, McGee said "there's only so far back they can go."

    No. There's only so far back they WILL go. There is a HUGE difference. Microsoft has CHOSEN not to support it, it's not that they can't.
  • "It's incredible to me that Microsoft would turn its back on Word 97 users," said Woody Leonhard, who has written books on Microsoft's Word and Office software. "They bought the package with full faith in Microsoft and its ability to protect them from this kind of exploit."

    Come on....Word 97? Who expects Microsoft to do something to fix problems in that? They have had 2 major (4 if you include the Mac versions) releases since then. You think Netscape is going to issue a patch for 4.7x now that version 7 is out? Just one example of many.

  • Ending support issue (Score:2, Informative)

    by 1000101 ( 584896 )
    Microsoft ending support on Office 97 is nothing new in the business world. Car companies regularly end their support for different models. After a while it is not cost effective for them to produce spare parts for these models. Also, look around everywhere in the technology industry. Companies are constantly discontinuing support. I have a Denon receiver who's fm tuner went out and I'm S.O.L. b/c they don't make spare parts anymore. All this complaining about their discontinued support for Office 97 is nonsense.

  • Really another reason to use openoffice? (Score:4, Insightful)

    by jpt.d ( 444929 ) <.abfall. .at. .rogers.com.> on Friday September 13, 2002 @02:19PM (#4252491)
    The logic of this eludes me.

    If you are using Word97 and somebody else is using WordXP. The other person will get the patch.

    Opensource software now...
    You are using KDE1 and somebody else is using KDE3. Security Hole X that is in both. KDE3 will get 'patched' or at least fixed, I doubt that KDE1 will get fixed. The only benefit here is that you could potentially fix it yourself, but if you are using KDE1 i doubt you really would.

    • Re:Really another reason to use openoffice? (Score:4, Informative)

      by yorgasor ( 109984 ) <.ten.shcetirt. .ta. .nor.> on Friday September 13, 2002 @03:07PM (#4252866) Homepage
      There is a big difference. Open source software developers rarely dish out patches. They can't, really. Windows software gets patched because they have complete control over the binary and know exactly what was shipped to customers. Open source software could be compiled on a dozen different platforms with who-knows-what kind of optimizations.

      Instead, they release a new version with the bug fixed. Usually code patches are available, but how many people using KDE actually compiled their version?

      Ok, so commercial software and open source software developers really want their users to use the most up to date versions. The difference is, MS wants their users to fork out a few hundred $$$ for their new fixes and gotta-have features. For KDE, you can just download the latest version or get it from a friend. That's why MS is evil for not patching '97. People paid a lot of money for it and expect MS to support it. I personally can't seen any feature worth paying several hundred dollars for an upgrade to Office 2000/XP over '97 and neither can millions of their customers.

      Now you tell me who's looking out for their users.

  • I imagine that all copies of Office XP will stop working on January 1, 2004 (or whenever the support promise runs out) due to some bug which "prevents proper start up of program file once the system clock passes 01012004:00:00:00, and instead displays upgrade flash screen and and crashes."

    Since the service period will have expired, Microsoft will not be fixing this problem, and will instead recommend upgrading to OfficeBall Z for $1000 a copy.
  • what a great way to kick Office XP (or maybe even Office 2000) sales way up. Remember when Office XP came out, and everyone said that there weren't enough new features or incentives to upgrade? Some people reported that they still used Office 97. Well, here's your incentive. Miscellaneous people 'stealing' Word docs.

    It makes me wonder if MS marketing is blowing the bug way out of proportion -- the average user hears 'Word 97 will let people STEAL your documents' and runs down frantically to the local CompUSA and buys a copy (or 2 or 3, depending on how many machines, of course :).

    I haven't seen a proof of concept or anything, but I wonder how serious this bug really is. Just my $0.02 US.

  • Check this out... (Score:5, Interesting)

    by Mustang Matt ( 133426 ) on Friday September 13, 2002 @02:26PM (#4252557)
    View some of the past word docs you've received in a hex editor...

    Near the bottom there is often information from other documents of the sender that they were recently working on. I don't know why it saves this. Maybe something to do with the undo buffer?

    At work I used to look at internal memos that would be sent out on a weekly basis and find out all sorts of other stuff that was going on.
    • Sort of. Word has a feature called "fast saves" that only adds revisions on saves (think like GNU diff) rather than going through and rebuilding the file. This was enabled by default until some later Word service pack (2K SP1 IIRC). This is also one of the reasons DOC files tend to have hideously-bloated filesizes.

      There's some other ways of getting weird extraneous data dumped into Office files -- see this Microsoft Knowledge Base document [microsoft.com] for more info. Fast saves are by far the worst culprit, though.

      If you're really concerned about this sort of thing, the best thing to do (besides using a different office suite) is to pipe public documents through GNU strings first to make sure nothing conspicuous is embedded.

  • Excuse me? (Score:3, Interesting)

    by InnereNacht ( 529021 ) <paulp@lappensecurity.com> on Friday September 13, 2002 @02:34PM (#4252623)
    "Furthermore, they plan on not fixing Word 97, leaving millions of users out in the cold. Yet another reason to try OpenOffice.org."

    They say that like other companies don't orphan software after 5 years. Programs become obsolete. Are we to ask Adobe to support Photoshop 4 still after it's had (at least) two major releases after it?

  • MS Word == newest P2P client? (Score:3, Funny)

    by richieb ( 3277 ) <richieb@@@gmail...com> on Friday September 13, 2002 @02:39PM (#4252649) Homepage Journal
    So, now I can search and find MP3 files by emailing Word files? How cool is that!

  • Word in Insecure (Score:3, Insightful)

    by minairia ( 608427 ) on Friday September 13, 2002 @02:41PM (#4252662)
    I write very basic Visual Basic scripts to automate the transcrition process for a large hospital. Miscosoft Word is completely insecure. Every Word document can contain one or more large complete applications that can interact with the internet, the network, a user's computer etc. Even with my very limited and basic knowledge I could (and have) accomplished the above. Every transcribed document in my department of this hospital is full of my code. If I was a certain type of person, the danger to patient privacy and confidentiality would be immense. I'm not like that but the idea that companies, hospital and governments world-wide use use Word on a daily basis is rather unsettling. I can only image the explots that someone who A) really knew what they were doing and B) lacked ethical standards could accomplish.

  • Bizarro World (Score:3, Insightful)

    by SomeOtherGuy ( 179082 ) on Friday September 13, 2002 @02:43PM (#4252678) Journal
    In the same week we wondered why Miscrosoft was making HP/Compaq kneel and beg to "be able" to provide MS Windows with each PC. (rather than Microsoft thinking themselves "lucky" to be moving so many copies of their software)....Along comes this as to where Microsoft may refuse to patch Word 97. Now I personally know of quite a few fortune 500 companies that are still 100% Word 97.....Would not this size and (clout) of a user base still warrant security patches to serious holes? (Well for most software companies it would -- but Microsoft's relationship..err..monopoly with their customer base in almost 180 degrees from everyone else.)

  • Intruders (Score:4, Funny)

    by Tablizer ( 95088 ) on Friday September 13, 2002 @03:01PM (#4252825) Journal

    This horrible bug could even allow invaders to install malicious or undesirable software such as MS-Word 97.

    Oh, wait

  • Yet another reason to try OpenOffice.org (Score:3, Insightful)

    by Leto2 ( 113578 ) on Friday September 13, 2002 @03:03PM (#4252845) Homepage
    Yet another reason to try OpenOffice.org

    What, you mean linus still produces patches for 1.1.x? Or that samba still fixes holes in 1.8.x? Or that apache still fixes holes in 1.2.x?

    • What, you mean linus still produces patches for 1.1.x? Or that samba still fixes holes in 1.8.x? Or that apache still fixes holes in 1.2.x?

      No, but Linus, Samba and Apache don't charge $200+ for the updated versions of their software with the bugs fixed.

    • What, you mean linus still produces patches for 1.1.x?

      Actually, there are still new releases to the 2.0 kernel series, which is the "circa 1997" (think "Word 97") kernel series. They're at 2.0.40-pre6 right now.

      Of course, perhaps the original poster meant that people should try OpenOffice not because patches are released for older versions of Open Source software, but rather because the upgrade to the latest, fully patched version is free?

  • A Fix! (Score:4, Informative)

    by gspeare ( 470147 ) <geoff&shalott,com> on Friday September 13, 2002 @03:58PM (#4253268) Journal
    Of course, there's a way to address this problem with...a Word Macro! :)

    Sub AutoOpen()
    '
    ' IncludeTextBarrer Macro
    ' Macro created 9/13/2002 by Geoff Speare
    ' Created for Word 2000, use at own risk, etc.
    '
    Dim count As Integer
    Dim vbFix As VbMsgBoxResult
    Dim blFoundOne As Boolean

    blFoundOne = False
    For count = 1 To ActiveDocument.Fields.count
    If ActiveDocument.Fields(count).Type = wdFieldIncludeText Then
    blFoundOne = True
    vbFix = MsgBox("An INCLUDETEXT field has been found. Would you like to lock it? " & _
    "(Select All and then Ctrl-4 will unlock all fields if you change your mind.)", vbYesNo, "INCLUDETEXT Exploit Detection")
    If vbFix = vbYes Then
    ActiveDocument.Fields(count).Locked = True
    End If

    End If
    Next
    If blFoundOne Then
    MsgBox "Your document may have a field which secretly includes text from another file. You may wish " & _
    "to Reveal Field Codes (ALT-F9) and examine the document closely before saving or distributing it.", vbOKOnly, _
    "INCLUDETEXT Exploit Detection"
    End If
    End Sub

Slashdot Top Deals

For God's sake, stop researching for a while and begin to think!

Close