OpenOffice.org Denies Macro Exploit A Problem - InformationWeek
IoT
IoT
News
News
6/5/2006
12:18 PM
50%
50%

OpenOffice.org Denies Macro Exploit A Problem

OpenOffice.org said it won't patch its software against a recently launched macro threat, nor is it likely to change the software's macro security feature.

OpenOffice.org, the open-source project that produces an alternative to Microsoft's Office suite, said it won't patch its software against a recently launched macro threat.

In a statement prominently displayed on the OpenOffice.org home page, the group also disputes applying the label "virus" to Stardust, the proof-of-concept exploit discovered last week by Kaspersky Labs.

"The 'proof-of-concept macro virus' showed that it is possible to write a simple 'virus-like' program using OpenOffice.org's macro language," read the statement. "This is a known risk with any capable macro language. To mitigate against this risk, by default OpenOffice.org detects if a document contains macros, displays a warning, and will only run the macro if the user specifically agrees. This behavior conforms to industry best practice."

The statement went on to say that the suite won't be patched, and by implication, that the software's macro security feature won't be changed.

"The OpenOffice.org engineers take the security of the software very seriously, and will react promptly to any new issues [but] this 'proof-of-concept' virus is not new information, and does not require a software patch. Technically, it is not even a virus, as it is not 'self-replicating' - with OpenOffice.org's default settings, it cannot spread without user intervention."

Although technically correct -- by definition, a computer virus is malware that self-replicates -- the term is often extended to refer to other forms of malicious code, including non-replicating Trojan horses.

In fact, Stardust wants to be a virus, but is so poorly written that it won't replicate. Two variants have been seen in the wild by Kaspersky Labs so far; both are flawed. "Like the previous version, this one doesn't work either, suffering from the same severe programming errors," wrote a Kaspersky researcher on the company's blog Saturday.

Rival security vendor F-Secure noted that that one of its researchers had warned of possible attacks via OpenOffice's macro language in a 2003 paper, and added that the suite's macro "security settings in the default installation much resembles older versions of Microsoft Office."

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
2017 State of IT Report
2017 State of IT Report
In today's technology-driven world, "innovation" has become a basic expectation. IT leaders are tasked with making technical magic, improving customer experience, and boosting the bottom line -- yet often without any increase to the IT budget. How are organizations striking the balance between new initiatives and cost control? Download our report to learn about the biggest challenges and how savvy IT executives are overcoming them.
Register for InformationWeek Newsletters
White Papers
Current Issue
Top IT Trends for 2018
As we enter a new year of technology planning, find out about the hot technologies organizations are using to advance their businesses and where the experts say IT is heading.
Video
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll