Office 2003 update blocks older file formats
34695
Latest service pack for productivity suite renders older file formats--including those for Word, Excel, PowerPoint--inaccessible.
88054
The UK government is at the forefront of a Microsoft scheme allowing access to the Office 2003 source code. Microsoft is to extend a programme offering governments access to its software code, it announced on Sunday.
55085
Microsoft advised users of its Mac version of Microsoft Office that a security patch inadvertently issued through its software update service was not ready for release. It advised those that may have applied the patch to uninstall the update.
270623
Microsoft has no plans to release a set of tools for Office 2007 that would allow users to access blocked file formats, even though it did so for customers running Office 2003 Service Pack 3.
417572
U.S. government office not yet upgrading to Windows Vista, Office 2007, or IE 7.
661250
From time to time I get e-mail in the file format MIME. My XP Pro under Windows and MSN Mail can't handle it, so I have to delete the message. I get lots of ABCs that make no sense. These e-mails come from friends and  probably hold some interesting info. - Tony Checkowski, Lansdale, Pa.
489771
In another carefully timed move to garner support for its document format still under consideration for an international standard, Microsoft today altered the terms under which use of its Office Open XML format by developers is permitted.
714165
Concerns about compatibility and other issues move DOT and NIST to prohibit upgrades to Vista, Office 2007 and IE 7, for now anyway.
121815
The new version of the personal finance program drops support for a widely used file format.
711699
The clock is ticking for organizations that chose to delay the deployment of Windows XP Service Pack 2. Come April 12, 2004, a tool that temporarily blocks delivery through automatic updating will cease to operate, allowing the upgrade to download.
326789
ODF fans say, 'we're not simple, we're elegant' Microsoft has made technical information for its older binary Office document formats available for download following pressure from participants in the ongoing, somewhat fiery, standardisation debate.â¦
510682
A Microsoft blog posting from a software engineer apologized for botching up communications around the blocking of old Office, Corel, and Lotus file formats in Office 2003 SP3. Why did anyone think these were security risks?
275748
(InfoWorld) - A wave of attacks targeting Microsoft's Office 2003 last year taught the company some tough security lessons it's now aggressively applying, a Microsoft software engineer said Friday. "When Office 2003 shipped, we thought we'd done some good work and that it would be a secure product," said David LeBlanc, a senior software development engineer with the Office team. "For the first two years after release, it held up really well, only two bulletins. [But] then people shifted their tactics and started finding problems in fairly large numbers." LeBlanc, one of the proponents of Microsoft's SDL (Security Development Lifecycle) initiative, and Michael Howard, the co-author of Writing Secure Code for Vista, referred to the spate of attacks in 2006 that exploited numerous vulnerabilities in Office 2003's file formats. The suite's core applications -- Word, Excel, and PowerPoint -- were all patched multiple times last year. "I can't gloss this over. You can look up the security bulletins that apply to Office 2003 yourself." The attacks, and the flaws they exposed, not only prompted immediate patches -- and the release this week of Office 2003 Service Pack 3 (SP3) -- but pushed Microsoft to step up efforts to track down bugs before shipping code. "We realized that fuzzing needed to be a much bigger part of what we did," said LeBlanc. "We were already on the road to doing that, but we had to do more of it, and get smarter at it." Fuzzing" is a process used by security researchers trolling for vulnerabilities and by developers looking for flaws in their code before it goes public. Armed with fuzzers -- automated tools that drop data into applications, file formats or operating system components to see if, and where, they fail -- programmers stress-test software. LeBlanc calls it "exercising the code." Office 2007, especially its file formats, was extensively fuzzed during its development, often with custom-built fuzzers written by the teams responsible for specific file formats, said LeBlanc. In turn, that led Microsoft's developers to go back into Office 2003 to run the same level of fuzzing against its code as was done with Office 2007. Fixes for flaws uncovered during the repeat round of testing were incorporated in SP3. The work's necessary, said LeBlanc, because of the length of time that Microsoft supports its corporate titles. "Do the math," he said. "Products are in mainstream support for five years, in extended support for another five. We're going to have to support something in the field for up to 10 years." That led to the realization that if it was to properly protect customers, Microsoft had to do more than just react to attackers' moves. "Part of our job is to try to figure out where the attackers are going and try to get there ahead of them," LeBlanc said. It's not an easy job, he admitted. "We shipped Office [2007] in early 2007, so mainstream support expires in early 2012. I can't possibly predict right now what the attackers are going to be doing and the techniques they'll be using in 2012. I wouldn't bet more than a beer that there won't be something in 2012 that I don't look back and go, 'Wow, I didn't see that coming'," LeBlanc said. Fuzzing as a preventative measure Among the ways the Office team is trying to get a step on attackers, said LeBlanc, is with stepped up fuzzing. He pointed to a presentation at last month's Black Hat security conference that described using generic algorithms to cover more code during fuzzing, a technique he said Microsoft had been working on for a couple of years. "Right now, [the technique] is only able to exercise relatively simple network protocols like HTML, which is a lot simpler than a Word document," said LeBlanc. "Given five years, will [attackers] figure out a way to scale that? Our job is to figure out [if they will] so we can protect our customers for the life of the product." Even the most diligent efforts, however, won't find every flaw, LeBlanc admitted. "One of the problems with fuzzing is it's really hard to say when you're done. Have you exercised the code sufficiently?" A good example of something testing didn't spot during Office 2007's development -- not to mention the even earlier work on Office 2003 -- was the bug in Excel's file format disclosed by the July security bulletin MS07-036. The vulnerability, which existed across the Office line, from version 2000 to 2007, was, said the bulletin, "in the way Excel handles malformed Excel files." It was the first bug in a core Office 2007 application's file format. "Something slipped through the cracks," LeBlanc acknowledged after looking over the MS07-036 advisory. "We like to stop these things, and overall, I think we did a pretty good job fuzzing Office 2007. This is the first one. It's kind of an example of why we need to continue to get smarter and apply more horsepower to this particular problem." Bottom line, he said, is that the developers working on Office know they have to crank it up a notch. "We're going to be continuing to push the envelope to find new ways to make the product as secure as possible," LeBlanc said. "We need to get way, way out in front of those guys." Computerworld is an InfoWorld affiliate
162032
Microsoft Corp. has failed in its attempt to have its Office Open XML document format fast-tracked straight to the status of an international standard by the International Organization for Standardization.
150152
The growing problem of accessing old file formats is a "ticking time bomb", the National Archives head says.
433213
Fix prevents users from sharing their files and printers with the entire Internet.
430128
Microsoft said on Friday that it has added Office binary formats to a list of technologies that are protected against patent-violation claims, answering criticism from some involved in the OOXML (Office Open XML) file-format standards process.The OOXML format is being considered as an international standard by the ISO (International Organization for Standardization), but translation between the original Office binaries and OOXML is necessary for there to be seamless document exchange between older versions of Office and Office 2007. Corporate developers and makers of other office productivity products need access to the formats in order to write converters between Microsoft&#39;s format and the possible standard.Microsoft has listed binary file format specifications for Word, Excel, and PowerPoint -- that is, .doc, .xls and .ppt -- under the OSP (Open Specification Promise). These file formats are the defaults in pre-Office 2007 versions of Office; Office 2007 was the first version to use OOXML as its default file format.Microsoft published the OSP in September 2006 as a promise that it would not take any patent-enforcement action against people who want access to the specs for technologies it has developed. Since then, Microsoft has been periodically adding to the list of OSP-protected specs, which can be found on the company&#39;s Web site. In a press statement, Microsoft said that adding the Office binaries to the list is to &quot;promote interoperability between the binaries and Open XML and make Office Open XML accessible to an ever-wider group of users and developers.&quot;The move came out of discussion in the ISO around OOXML as national standards bodies requested more open access to the Office binaries, said Brian Jones, an Office program manager, in a posting on a company blog last month.According to Jones, the specs for the binaries already had been available royalty-free via e-mail to anyone who requested them as outlined in an article in Microsoft&#39;s Knowledge Base. But since the national bodies were concerned with the steps someone had to take to get access to the binary formats, Microsoft -- working with an Ecma International technical committee, Ecma TC45 -- decided to make it easier for people to get them, he said.Microsoft has been working to fast-track OOXML through the ISO approval process through Ecma, another international standards body, since November 2005. Ecma approved OOXML in December 2006, but approval by the ISO has been more problematic. A final vote on ISO is expected in March after an ISO ballot resolution meeting for the OOXML format, scheduled for Feb. 25-29.To help companies build connectors between the binaries and OOXML, Microsoft on Friday also went live with an open-source project on SourceForge to create software tools, guidance and show how a document written using the binary formats can be translated to the current ISO spec for OOXML, ISO/IEC DIS 29500. The resulting translators will be available under the open-source Berkeley Software Distribution license, and members of the community are free to use the translators, submit bugs and feedback, or contribute to the project as they wish, Microsoft said.Translators already exist between the Office binary formats and OOXML&#39;s rival file format, ODF (Open Document Format), which already is an approved ISO standard. For example, the Sun ODF Plug-in for Microsoft Office enables conversion between Microsoft Office documents to and from ODF.