Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×

OpenOffice.org Security 'Insufficient' 184

Posted by CmdrTaco from the taunting-crowds dept.
InfoWorldMike writes "IDG News Service's Robert McMillan reports that researchers at French Ministry of Defense say vulnerabilities with open source office suite OpenOffice.org may rival those of Microsoft's version. With Microsoft's Office suite now being targeted by hackers, researchers at the French Ministry of Defense say users of the OpenOffice.org software may be at even greater risk from computer viruses. "The general security of OpenOffice is insufficient," the researchers wrote in a paper entitled In-depth analysis of the viral threats with OpenOffice.org documents. "This suite is up to now still vulnerable to many potential malware attacks," they wrote. The OpenOffice.org team has already fixed a software bug discovered by the researchers, and the two groups are in discussions about how to improve the overall security of the software. "The one real flaw in the programming logic has been fixed," said Louis Suarez-Potts, an OpenOffice.org community manager. "The others are theoretical.""
This discussion has been archived. No new comments can be posted.

OpenOffice.org Security 'Insufficient' More

OpenOffice.org Security 'Insufficient'

Comments Filter:

  • "theoretical" (Score:5, Insightful)

    by dmiller ( 581 ) <[gro.tordnim] [ta] [mjd]> on Sunday August 13, 2006 @04:45PM (#15899395) Homepage
    It is disappointing to see a free software project dismissing threats as "theoretical". Today's "theoretical" vulnerabilities are tomorrow's exploits. Worse, the article hints that these threats are fundamental design flaws - the developers should be working to fix these and not issuing PR speak to cover them.

    • Re:"theoretical" (Score:5, Informative)

      by morgan_greywolf ( 835522 ) on Sunday August 13, 2006 @05:09PM (#15899478) Homepage Journal
      The PDF presentation that the group gave was en Français, but I got the gist. I'd post a translation, but my French is a little rusty. ;) Anyway, they seem to be saying that because OOo doesn't support authentication certificates for documents or macros, and because OOo has an API that allows you to program in several different languages (Python, VBScript, Perl, C++, etc.) and that OOo has no solid verifiable security model, that the suite is fundamentally insecure.

      I can see where some of this gets dismissed as "theoretical" -- for instance, while OOo has such an API, this isn't any more secure or insecure than the fact that other applications, like MySQL, for instance, have a similarly flexible API. Ditto for Microsoft Office or any operating system.

      The information on authentication certificates seems a little outdated -- OOo 2.0 supports digital signatures for documents and macros and even security settings that prevent macros from being run that are not signed. I think that as for a solid, verifiable security model, OOo 2.0 seems to have one based on digital signatures.

      • Re:"theoretical" (Score:5, Informative)

        by Red Alastor ( 742410 ) on Sunday August 13, 2006 @05:39PM (#15899572)
        I speak French, let me translate.
        1. "Official" MS Office competitor.
        2. Share of the market rising.
        3. Cheap but...
        4. What about the real security of OpenOffice ?
        5. Viral analysis by proof of concept
        6. Numerous integrated programming languages : script shell, VBScript, Python, Perl, Asp, Java.
        7. Rich macro developing.
        8. Numerous existing hijackable execution points
        9. No protection mecanism for macros
        10. zip format is makes virus penetration easy.
        11. Macro security is easy to bypass. "Trusted" folders are defined. Any macro placed in those folders is by definition, trusted.
        12. Document signature do not really consider macros. Bypassing possibilities
        13. Macros can be linked to events or services.
        14. Other mechanisms : macro chaining, hypertext links, inter-application execution, OLE
        15. Many mechanisms are usable for an infection
        16. All known viral techniques known for Microsoft Office can be translated under OpenOffice.org
        17. Every kind of infection is doable. (Infection and auto-reproduction)
        18. Globaly, OpenOffice's suite is a bigger infection risk than Microsoft's suite.
        19. No real security concepts.
        20. Many functional viral roots were made as proof-of-concept
        21. Infection successful no matter the security setting of the user.
        22. Some senarii can act without alerting the user in any way (scenarii is a stupid plural in French too but they used it in the original)

        Then they go on to explain (still in powerpoint bullets) that they managed to write a macro that sends an e-mail with an attached file which then executed C code which modified dicOOo.

        And they conclude that infection risk under OOo is MAXIMAL and its use should be discouraged for security reasons.

        • Re:"theoretical" (Score:5, Informative)

          by Red Alastor ( 742410 ) on Sunday August 13, 2006 @05:54PM (#15899617)

          I'm replying to my own post but the other was the translation and this is what I think of it. I think it's bullshit.

          Point number 10, what the fuck ? zip is just a comression format. Point number 11, trusted folders are defined by YOU. So most people don't even have them. But if it's convenient to you to define a folder where all macros are trusted how is it different from accepting every macro while you open the document ? It must be quite convenient for developers who want to test their macros. Most other points ? Way too vague to mean anything. Beside, if the danger for an office suite which isn't really attacked right now is "maximal", how should be classify MS Office ?

          And their famous proof-of-concept... they won't even tell us how they got it to run. My guess is that they defined a trusted folder and put it in.

          Until they reveal that, this document is worthless. Like that other proof-of-concept from I don't remember which AV vendor. Their macro (if you accepted it) would download a porn picture from the net and put it in the document. I guess it's much more dangerous than sending documents with the picture already in.

      • Re:"theoretical" (Score:4, Insightful)

        by colmore ( 56499 ) on Sunday August 13, 2006 @06:13PM (#15899686) Journal
        Someone needs to explain this to me. Why do office suites need these features? For what are they used? I've never worked in a big office that actually uses the macro and scripting features of productivity software.

        Can intra-office communication not be done via RTF? Why do we need document formats that rival PDF and layout-software fileformats in complexity?

        It seems like you could avoid all of this using a smaller array of utilities and custom scripts for office productivity, it just strikes me as impossible to create a scriptable, monolithic, document engine that won't have some sort of security hole on some platform. It seems like a cluster of smaller, more agile tools is the way to go.

        • Re:"theoretical" (Score:5, Interesting)

          by TheRaven64 ( 641858 ) on Sunday August 13, 2006 @07:38PM (#15899927) Journal
          I've never worked in a big office that actually uses the macro and scripting features of productivity software.

          I worked for a little while for a (very large) organisation that made heavy use of scripting in Office. Every single type of document had an official corporate style. It had a (scripted) wizard that went through and added the sections you want, automatically filled in various bits of it, etc. After five minutes with the wizard you would have a multi-page skeleton document which would then just need text adding.

          If I had been implementing the system from scratch, I would have made it intranet-based, with a TeX backend for generating PDFs, but they had an enormous amount invested in the it, and a team working on updating and fixing the templates. It was sometimes a problem ensuring that you had the right version installed (which is why I would go for a client-server model), but even that could probably be fixed by scripting (simply have the wizard check it was the latest version and fetch / install it if now).

          • Re:"theoretical" (Score:4, Insightful)

            by swillden ( 191260 ) * <shawn-ds@willden.org> on Sunday August 13, 2006 @10:58PM (#15900546) Journal

            If I had been implementing the system from scratch, I would have made it intranet-based, with a TeX backend for generating PDFs

            If I'd been building it, for use with OOo, I'd have given it a backend that generated the OpenDocument data without using any macros within the application. The great thing about having a fully documented, open format like OpenDocument is that you can easily generate and manipulate documents with any tool that's convenient.

            Of course, the same is true of TeX, but if you generate OpenDocument format, then you can use OOo to edit and maintain it. In most environments the users are more likely to be comfortable with that than with TeX.

            I think the openness of the format actually eliminates many of the reasons that macros are so important in the Microsoft Office world.

            • Simply said, people don't like to start up 2 programs just to create one text document. And writing a complete GUI for this is not productive. There is no shame in using templates and/or macros for this. As long as the macro system is restricted to the document, there is no reason not to use macro's. If you need more, there is no problem in using some plugin either. This whole "scripting is bad" is just a problem because they created too big a sandbox.
              • Have you ever actually generated any OpenDocuments? A bit of code to generate some custom XML, plus an XSLT stylesheet to convert it makes it *extremely* easy to build them. More powerful, flexible, extensible and often quite a bit simpler than using macros. Oh, and no security problems at all. It's a Better Way.
        • I can't understand why office suites and their formats need macros, at least when they're embedded in the document. I think it's quite simple: don't mix data and code. If you need macros/scripts/whatever, put them into another file (and format) separate from the document. That way it's easier to sort out which is which e.g email filters.

          • Re:"theoretical" (Score:3, Insightful)

            by Planesdragon ( 210349 )
            I think it's quite simple: don't mix data and code.

            Data and code are fundamentally linked. You can put an artificial barrier between them, but that doesn't do much if you lose functionality by doing so.

            Let's say that I've got an Excel Sheet (I do) that needs to call a custom function that Excel doesn't ship with (I do, as well). While it would, in theory, be possible to move that code to a seperate macro in a "code" file somewhere, I'd still have to find a way to let anyone who opens my document get at th
            • Hmm, I guess I wasn't talking about simple functions when I said "don't mix data and code". They should be OK. The problem comes with the stuff that allows applications to be written, and especially with the ability of "hooking" into internal functionality of the office program. That's where you get self-replicating worms happening. I still think that sort of stuff should be external to the office program and file format. The thing is that MS makes Visual Basic and then uses "Visual Basic for Applications"
          • Yes, if the macro can modify, edit, or destroy _this_ document, then someone can send you whatever corrupt documents they wish. They could not set global settings, or operate outside the document. No problem, really.

            If a macro lets you write documents that can change other documents, your system, or the outside internet, the the program is as broken as ms office.
        • Can intra-office communication not be done via RTF?

          It easily could - but that's beside the point. THe fact that you can run "virus-free" software on Windows does not preclude you from (inadvertently) running something virus-infected.

          You may do all your company internal documents in RTF even in MS Office - but if one of the company secretaries opens up a document sent by an outside source (maybe a seemingly legitimate one), which DOES contain a virus, your system's security is still screwed. Your RTFs might
        • I have and do. I wish people would stop saying "I don't use it so it must be pointless"; macros are very useful and save me a lot of time. Excel doesn't come with the be all and end all of functions; sometimes a user-defined one is necessary. Word doesn't allow for every possible permutation; sometimes a little program is needed. Custom scripts would be good too, I hate having to load Word to generate a document, but when the document is already open and being edited a macro makes more sense than an externa

        • Re:"theoretical" (Score:3, Informative)

          by jimicus ( 737525 )
          Someone needs to explain this to me. Why do office suites need these features? For what are they used? I've never worked in a big office that actually uses the macro and scripting features of productivity software.

          What generally happens is this (and I'd expect it to be much the same for most of Office's macro features):

          Department A perceives a need for a complicated spreadsheet or a small database. It's not really complicated enough to go through the "pass it up the line and set up a project in conjunction
          • The "IT" Department of that company isn't doing it's job.

                Fred shouldn't be capable of installing any software to create a database on any computer within his department.

                At best, Fred could create an Excel Spreadsheet. Depenending upon the amount of data going into the file, the IT Department would probably hear about it sooner or later, as Excel simply cannot hold that much information without getting really wonky.
            • Fred doesn't need to be capable of installing any software. It's already installed; it's called "Access".

              And trust me, by the time the IT department hears about it it's probably already taken a strong foothold.
    • "It's only a theory."
    • The sentence above that also says:
      ""This suite is up to now still vulnerable to many potential malware attacks," they wrote. The OpenOffice.org team has already fixed a software bug discovered by the researchers, and the two groups are in discussions about how to improve the overall security of the software."

      So the important issue was fixed and now they are discussing how to improve security overall, it sounds to me like they handled it perfectly.

    • Re:"theoretical" (Score:2, Insightful)

      by Marcion ( 876801 )
      It seems to be OpenOffice on Windows. I have 64bit Linux, behind an Selinux hardened firewall - nothing is able to exploit office software from over the network. I send out documents in PDF format. People likewise send me docs in PDF or text (or Word arrr). If I was sent an ODF then I would probably open it with Abiword, is the macro going to exploit that, what about Koffice?

      Not being part of the software monoculture has enough security benefits that I doubt it would ever pay to attack us when there are eno

    • Re:"theoretical" (Score:3, Informative)

      by mspohr ( 589790 )
      TFA said they were working to fix them in cooperation with French security experts. They were not "dismissed" but rather they have started to patch them.

  • Thats a cool thing with open source (Score:4, Insightful)

    by CrazyJim1 ( 809850 ) on Sunday August 13, 2006 @04:46PM (#15899403) Journal
    If someone finds a bug or flaw, it doesn't take someone else very long to fix it. Now when it comes to corporations, they have to wait to bill you for the next release, and you pay it too because the fix of bugs alone justifies buying the new version.

    • Re:Thats a cool thing with open source (Score:5, Insightful)

      by daniil ( 775990 ) <evilbj8rn@hotmail.com> on Sunday August 13, 2006 @05:03PM (#15899458) Journal
      The cool thing about corporations is that it takes them longer to produce new bugs and set them loose in the wild.

    • ... is that when they do have a security 'fix', they force you to update by downloading the entire suite... they don't have differential patches. I personally get sick and tired of having to download around 100 MBytes of app, uninstall the original, and re-install the new. Granted on my Linux box the package updater will do all three, but the updater takes forever to download the files. Quite frankly it is a pain in the ass. Sometimes I delay installing an update because of it (sometimes quite a while).

    • I've seen plenty of security bugs in open source code that don't get updated right away. Open source is not all that different from closed source software in this sense. While it certainly is fun to pretend open source is perfect and is in every way better than commercial software, that simply is not true.
      • On the server side, critical security bugs are fixed on average of one to 3 days in Linux. Be it a kernel issue, sshd, apache, bind, vsftpd/proftpd, sendmail or any other widely used daemon.

        Minor programs not as fast but still faster than MS and the main programs that offer the greatest possibility for root exploits have always been fixed in just a day or two. I welcome any example where it took 4 weeks for a fix for a main package.

        I don't think Linux is safer because I use it on my servers, I use it on m

        • "I welcome any example where it took 4 weeks for a fix for a main package."

          Well offhand, here is one [sourceforge.net] opened 3 years ago which still hasn't been fixed, though it would be difficult to exploit. Basically what happens is that that a machine with trust level 4 (the default is 3, so again this would be difficult to exploit) to gain level 5 access (meaning they can run arbitrary commands on computer running the service. No, STAF/STAX is not as big as Linux (which is why I was talking about open source in gen

    • Yeah, open source is great. I'm so happy that after a year nobody responded to my Firefox bug report marked as security related issue. After a year I suppose someone got a notification email and re-wrote the summary, but it is still marked as "NEW". This bug is over a year old, no way it could be regarded "NEW". It should be "FIXED" or at least "INVALID" (or "GET A LIFE, MORON"). Currently it is assigned to "Nobody's working on this, feel free to take it". Yay, the power of open source.

      I'm sorry that you pu
      • But happy-go-lucky progress just doesn't cut it for security efforts. BIND is open source as well, but its security track record has been awful, especially by comparsion of the simplicity of a DNS server versus web servers (or any other kind of application)

        Perhaps a bit ironic that you mention BIND. It's been quite a while since there's been a big security problem in BIND, and is currently the driving force in the largest security update to the DNS protocol in, like, decades - DNSSEC.

        Yes, the BIND sources w
    • Thats a cool thing with open source...If someone finds a bug or flaw, it doesn't take someone else very long to fix it. Now when it comes to corporations, they have to wait to bill you for the next release, and you pay it too because the fix of bugs alone justifies buying the new version.

      Last I heard, Sun was still providing the money, manpower, leadership, and material resources going into the development of OpenOffice.org. That contributions from outsiders were trivial, given the scale and complexity of

      • contributions from outsiders were trivial, given the scale and complexity of the project.

        Sun does about 80% of the work on OpenOffice.org. This is a significant majority, but I would hardly classify 20% a trivial. The second largest contributor is Novell. Since they have OpenOffice.org deployed on every single one of their employees machines, they do a lot of work fixing dogfood bugs.

    • If someone finds a bug or flaw, it doesn't take someone else very long to fix it. Now when it comes to corporations, they have to wait to bill you for the next release, and you pay it too because the fix of bugs alone justifies buying the new version.

      The problem with Open Office is that someone could check the fix in tonight but you wouldn't necessarily see a 2.04 until whenever they felt like releasing it which could be months or more. So really it's irrelevant in that situation that you're dealing with

    • However patching suffers from the same problem of virus scanners in that it's usually reactionary, they only patch bugs after they're known.

      A smart hacker will find an exploit, not reveal it to anyone and only use it on select targets. It could be a long time before this exploit is noticed and fixed. One of the flaws of OSS is that a hacker can find flaws that haven't been fixed in a much easier way because the source is in front of him.

  • Let me think... (Score:5, Funny)

    by DumbSwede ( 521261 ) <slashdotbin@hotmail.com> on Sunday August 13, 2006 @04:47PM (#15899407) Homepage Journal
    which should I use, hmmmm...
    Microsoft's Office Suite IS being attacked.
    OpenOffice could, possibly, theorectically, be attacked.

  • Many eyes at work. Sounds like a + not - (Score:5, Insightful)

    by MCRocker ( 461060 ) * on Sunday August 13, 2006 @04:48PM (#15899413) Homepage
    This sounds like a strength of the open source model. Many eyes can include security auditors too. The weaknesses get reported and fixed.

    The closed source model doesn't offer the same level of opportunity to find flaws. Even when people do find flaws in closed source products the publishers are as likely to bury the report, deny the flaw it exists or use DMCA to sue the people who disclose the problems.

    Chalk this up as a win for the open source model... at least for large high visibility projects like Open Office.
    • "This sounds like a strength of the open source model. Many eyes can include security auditors too. The weaknesses get reported and fixed."

      This seems to be the call of the open source zealout, but it is not reality. 99% of the people using Open Office are users. The other 1% contain people that might have the ability to look at it, but may not have the time or patience.

      I have been involved with many open source projects over the past couple of years and it usually ends up like this:

      1) someone emails a bug

      • "This sounds like a strength of the open source model. Many eyes can include security auditors too. The weaknesses get reported and fixed."

        This seems to be the call of the open source zealout, but it is not reality. 99% of the people using Open Office are users. The other 1% contain people that might have the ability to look at it, but may not have the time or patience.

        While I agree that the attitude that open source fixes all vulnerabilities is blasee, your statement is also a bit too broad. Secure proje

      • Well, considering that a higher proportion of the users of OSS will contribute fixes and bug reports than the equivelant for proprietary software, it doesn't matter as much if fewer of the main programming team are always available. Also, companies that are worried can fix security threats internally and submit the changes back. I'm not a major OSS developer but I've contributed many bug reports to GNOME and some to the linux kernel, and they've all been fixed. I have submitted some usability improvements i

      • "This sounds like a strength of the open source model. Many eyes can include security auditors too. The weaknesses get reported and fixed."

        This seems to be the call of the open source zealout, but it is not reality. 99% of the people using Open Office are users. The other 1% contain people that might have the ability to look at it, but may not have the time or patience.

        Right... as compared to closed source, where 0% have the capability of auditing the source code.

        Of course, things aren't as black and white

    • The problem with OpenOffice is that its a massive project (120000+ files) and incredibly daunting to build with many inter-dependencies on non-trivial 3rd party packages. How many eyeballs actually look at the code, and can you say for sure that it is any more than for MS Office?

      Now don't get me wrong. I *only* use OO for home use (MSO is required for office work), but it would be incredibly bad assumption that OO has less exploits than MSO. It's simply that the bad guys have bigger fish to fry. OO is a t

  • The Bad News Is... (Score:5, Funny)

    by RobotRunAmok ( 595286 ) on Sunday August 13, 2006 @04:52PM (#15899423)
    ...that OpenOffice has security flaws.

    The Good News is that in the time it takes the suite to open and load an infected document the malicious hacker has been captured by the FBI, brought to trial, convicted, and a patch made available.

    • Re:The Bad News Is... (Score:2, Informative)

      by miro f ( 944325 )
      actually since I found the OpenOffice.org quickstarter (hidden in the preferences under memory) I never went back. Loading times have decreased a lot (sometimes it even loads instantaneously). Sure it takes more memory while my system is idle but I've never run out before...
    • That office suites alwais will have security flaws as long as they are feature driven (which is what the current user seems to like). Almost any piece of software that is driven by features and functionality becomes unreliable and insecury in time.

      Can we stop complaining about MS Office now? Can we all get back to reality and go to work?

  • What makes them think MS Office isn't vulnerable? (Score:5, Insightful)

    by foreverdisillusioned ( 763799 ) on Sunday August 13, 2006 @04:52PM (#15899424) Journal
    I'm assuming that the vast majority of these alleged vulnerabilities came about as a result of them examining the source code. Since Microsoft Office is closed source, it may have just as many potential exploits or more. The difference is OO.o's vulnerabilities are known and thus can be guarded against or even patched by a third party. MS Office's potential exploits are unknown and thus may be released as zero-day exploits, and even when they are known we're at the mercy of MS to release a timely and effective patch.

    I fail to see how this is a black mark against OpenOffice.org.
    • I fail to see how this is a black mark against OpenOffice.org.

      I don't either. But you know that if MS (or its shills) can make it appear so, they will.

    • I fail to see how this is a black mark against OpenOffice.org

      I don't think that's (neccessarily) the point. Whatever MS does about their Office security flaws does not really concern me any longer. There's almost nothing that could ever make me use MS Office again. But so what. The point isn't which suite is better, the point is: OpenOffice.org still has flaws, and those should be fixed. In this context the statement "The [other flaws] are theoretical" does not make me feel good. I want even theoretical

  • MMKay.. Interesting, but.. (Score:4, Informative)

    by wwiiol_toofless ( 991717 ) on Sunday August 13, 2006 @04:56PM (#15899438)
    OpenOffice.org is FREE! FREE I tell you! Given the choice between a known-to-be-vulnerable $200 suite and a hypothetically-vulnerable Freeware suite, I'll take the latter. The day I discovered OO still ranks in the top 10 of my favorite computing moments of my life.
    • The day I discovered OO still ranks in the top 10 of my favorite computing moments of my life.
      1. Day I discovered OO
      2. Day I discovered Knoppix
      3. Day I discovered Debian
      4. Day I got streaming audio to work on Linux
      5. Day I discovered what buffer overflows were
      6. Day I discovered Opera (sweet! an alternative to IE)
      7. Day I discovered Perl
      8. Day I discovered Python
      9. Day I discovered LAN parties
      10. Day I discovered the Holy Handgrenade of Antioch in Worms

  • OO.org is vulnerable (Score:4, Insightful)

    by Elektroschock ( 659467 ) on Sunday August 13, 2006 @05:05PM (#15899465)
    True. Guess the same applies to Abiword. But who will write an Abiword worm?

  • leaked MS Expense Report (Score:5, Funny)

    by Gothmolly ( 148874 ) on Sunday August 13, 2006 @05:07PM (#15899472)
    From: sballmer@microsoft.com
    To: accounting@microsoft.com

    Attached find my receipts for the recent meetings I had with the French Ministry of Defense:

    First class plane ticket to Paris: 2100 USD
    Swank hotel in Paris: 1800 USD
    Dinner for 2 at a spiffy restaurant: 800 USD
    Hookers and blow for MoD officials: 5000 USD

    Business Justification For Expense: I believe that we will sell ONE MILLION copies of Office to the French MoD.

    --Steve

    PS If you get a bill from the hotel about a broken chair, it was like that when I got the room, so I don't think we should pay it. Bill said it would be OK.

  • Gentle Reminder About the Ministry (Score:5, Insightful)

    by mpapet ( 761907 ) on Sunday August 13, 2006 @05:09PM (#15899477) Homepage
    This is the MINISTRY OF DEFENSE where draconian access control and accounting should be routine.

    It's very difficult to go from that environment back to the real world where security is measured by successfully implementing long passwords in a company.

    Making the inductive(?) leap that OpenOffice.org is insecure is a really long leap of faith. Are there holes? Probably.

    In many ways, this is good news because the open source application is being picked over with a fine tooth comb by a large ministry.

    Bring it on!

  • The imporant news here (Score:4, Funny)

    by andreMA ( 643885 ) on Sunday August 13, 2006 @05:12PM (#15899486)
    ... is that France has a Ministry of Defense.

  • Insecure by association? (Score:5, Insightful)

    by quantaman ( 517394 ) on Sunday August 13, 2006 @05:13PM (#15899492)
    My understanding is that a lot of the security problems in MS Office comes from bad design wrt things like macros which make it very hard to secure the system. If OpenOffice is working towards compatibility with MS Office they may be having to deal with the same types of security issues in trying to secure bad macros and such. Thus it makes sense that OpenOffice would be just as, or even more, insecure than OpenOffice, not only do they have many of the same classes of exploits, but they also have greater pressure to rush these features out (for compatibility reasons) and up till now haven't had the motivation of attackers actively exploiting them to force them to spend the necessary time on security.
  • Well, be careful of Other People's Documents (OPDs)!

    I always turn off any live macro support in OpenOffice.org and Microsoft Word, and hope that is good enough security. I also tend to open Word .doc files I receive from other people in OpenOffice.org.

    A little off topic, but I have been blogging about this lately: whether I am writing up short project documents or working on a for-fun book project (Ruby AI Programming), I find that just using Latex is much more productive for me. One reason is just seeing r

    • Re:OPDs and Latex (Score:4, Informative)

      by iabervon ( 1971 ) on Sunday August 13, 2006 @07:05PM (#15899823) Homepage Journal
      The main problem with LaTeX is that, if you use it for much of anything, you'll never have the patience to deal with a word processor again, and will therefore be unable to work with businesspeople on documents. And you'll be forever annoyed by the minor formatting flaws in everybody else's documents, like when paragraphs spanning page breaks have a single line on one of the pages.
    • This is interesting in that the slide show referenced by TFA was produced with LaTeX and dvips - on the 4 of June, 2006. News for nerds is a bit behind ...

  • CVE-2006-2198 (Score:5, Informative)

    by tetromino ( 807969 ) on Sunday August 13, 2006 @05:18PM (#15899507)
    I think that the flaw they are talking about is CVE-2006-2198 [mitre.org], which was fixed in OOo-2.0.3. It was pretty nasty, executes arbitray macro without alerting or prompting the user. However, given that the mistake was already found and fixed, what else does the French Ministry of Defence have to complain about?
  • From the summary: ...vulnerabilities with open source office suite OpenOffice.org may rival those of Microsoft's version

    Microsoft has a version of OpenOffice? Isn't OpenOffice's closed version StarOffice, which is owned by Sun, not MS?

  • The actual problem is DicOOo (Score:4, Informative)

    by Animats ( 122034 ) on Sunday August 13, 2006 @05:27PM (#15899538) Homepage
    Here's the attack:

    Installation d'une fonction offensive C dans la macro DicOOo.
    La fonction C est exécutée à l'installation de DicOOo.

    "DicOOo" is an installer for dictionaries into OpenOffice. Unfortunately, it seems to have too much power, and can be replaced or induced to install other things. This is an add-on to OpenOffice, and apparently an unsafe one.

  • Maybe we need to take a step back... (Score:5, Interesting)

    by Harker ( 96598 ) on Sunday August 13, 2006 @05:29PM (#15899544)
    a decade or more, at least.

    How about we stop writing word processors and spreadsheets that are capable of running code (other than its own)?

    I remember back when I was big on a certain usenet news group, we had a discussion about an email virus. The claim was, when you opened the email (don't recall the name off hand), it would do all sorts of nasty things to your computer, and possibly to your girlfriend/wife/sister/etc. The entire thing was a hoax that preyed on ignorant computer users, and urged them to spread the word.

    My argument at the time was basically that an email client could not, or should not execute the text within the email itself, and any client that did, shouldn't be used.

    Now I use Outlook on a daily basis, and guess what?

    So, let's take a step back to simpler, less efficient applications. Get rid of what causes the vulnerabilities in the first place.

    Now where did this box come from?

    H.

  • Alternatives (Score:4, Interesting)

    by Doc Ruby ( 173196 ) on Sunday August 13, 2006 @05:30PM (#15899546) Homepage Journal
    How secure is MS software that responds to vulnerability discoveries by ignoring them or lying about them, fixing them after months or even several versions (years) later? Because users have to rely on MS to fix them.

    Compared to OO.o, which anyone can fix, even the French government itself, but which does fix bugs quickly.

  • The only problem with open office is (Score:3, Funny)

    by popsicle67 ( 929681 ) on Sunday August 13, 2006 @05:32PM (#15899553)
    It doesn't have a sales staff that can kiss a ministers ass.
  • 1) Click Tools menu.
    2) Click Options.
    3) On the left side, click the Security category.
    4) Under "OpenOffice.org Basic Script", set "Run macro" to "Never".
    5) Under "Hyperlinks", set "Open hyperlinks" to "Never".
    6) Under "Java", untick "Enable".
    7) Under "Enable", untick "Plug-ins" and untick "Applets".
    8) Click OK.

    OpenOffice.org will now be configured for best security. Some functionality will not be available. Depending upon your system, you may need to repeat these steps for each user account.

  • Just Turn Macros Off (Score:3, Interesting)

    by xdxfp ( 992259 ) on Monday August 14, 2006 @07:58AM (#15901706)
    Why does MS Office have all these fancy features that only a few people use, yet they open up a world of vulnerabilities? I use MS Excel to write a spreadsheet with some basic formulas, and MS Word to write documents that I could just have easily written in WordPad (minus the spell check). Turn off macros by default, and have a generic "you're running a macro and this is unsafe" popup (which I beleive they already do). If the user clicks yes unwittingly, then they're probably too stupid to read the dialog asking them about the signature, and they're screwed anyhow.

Slashdot Top Deals

Never test for an error condition you don't know how to handle. -- Steinbach

Close