Skip to content

Channel Register

Microsoft releases security tool for Office 2003

22 May 2007 22:34

Defangs Office doc, spreads the XML love

SlashdotDiggdel.icio.usReddit
® [Mobile]

« Back to article page

Too little too late 

By Brent Gardner
Posted Tuesday 22nd May 2007 22:55 GMT

Now the question is, why in the hell did they allow for executable content in their file formats in the first place?

Also, what does it mean: "or the tool will crash". I suppose we are to assume that it will crash in a way that is not a potentially dangerous buffer overflow?

Security tools crashing does not bread confidence.

I am amazed! 

By frank denton
Posted Wednesday 23rd May 2007 04:12 GMT

I had to read that twice :

"During the conversion of an unsafe file, MOICE will fail to convert the file, create a safe version of the file, or the converter itself will crash ," ....

"The mere process of conversion and achieving one of three possible outcomes is what protects customers."

So, if I write an app that 'achieves' the outcome of crashing, that protects the user of my app? Or is it the fact that the app 'achieves' one of three defined states that protects the user?

I've written lots of apps that crash so maybe I can present myself as a safety critical software programmer.

Macros 

By Stuart Van Onselen
Posted Wednesday 23rd May 2007 06:22 GMT

If I understand correctly, they're stripping out ALL the macros and VBScript, good or bad.

If so, how do you preserve beneficial macros?

One of the standard points made by M$ whenever someone wants to rip out Office and replace it with e.g. StarOffice, is that all that company's wonderful corporate macros will have to be re-written.

If their new official position is that macros are more trouble than they're worth, then they've shot down one of their own selling points!

The next step 

By Pascal Monett
Posted Wednesday 23rd May 2007 08:07 GMT

I'm now eagerly awaiting for the inevitable patch that corrects a vulnerability in the MOICE tool. Either that, or the revelation that a virus has been found in the wild that takes advantage of MOICE crashing to insert itself into the code.

After all, it wouldn't be realistic to suppose that they've managed to program a simple tool without another buffer overflow vulnerability, now would it ?

Wonderful... 

By Anonymous Coward
Posted Wednesday 23rd May 2007 10:49 GMT

... so now I can expect about a zillion spam e-mails with MOICE.exe attached, ready for me to run, or even (gasp!) a helpful link to MOICE.exe somewhere on the Internet, also ready for me to run to "secure" my system...?

I will file details of this helpful new software tool under "Useful", next to "Phlogiston meters" and "Fireguards (chocolate)"...

:-(

Unstable by design 

By Anonymous Coward
Posted Wednesday 23rd May 2007 11:38 GMT

"...or the converter itself will crash...",

Oh yeah, give it to me baby, now I really have heard it all and can die happy. MS finally 'fesses up to what the rest of the world new for years. Nurse ! Nurse ! I need resuss

Oh look 

By SImon Hobson
Posted Wednesday 23rd May 2007 12:36 GMT

A tool which takes you office documents and converts them to a format unreadable with older versions ! So no pressure then to stop using old versions (ie to stop NOT paying more money to Microsoft).

Link to wrong download? 

By Anonymous Coward
Posted Wednesday 23rd May 2007 14:08 GMT

I was going to have a look see, but the link you provided goes to a "Microsoft Office Compatibility Pack" - which I don't think is what you intended.

Quick searches for MOICE and the acronym spelled out didn't turn anything up

Am I missing something?

Related Whitepapers