Microsoft urges Office users to block Flash Player attacks
Suggests configuring advanced blocking tool to protect Excel 2007 and older
Computerworld - Microsoft yesterday urged users of older Office suites to install and run a complicated tool to protect themselves against ongoing attacks exploiting an unpatched bug in Adobe's Flash Player.
"For users of Office prior to 2010, the Enhanced Mitigation Experience Toolkit (EMET) can help," said Andrew Roths and Chengyun Chu, a manager and security engineer, respectively, with the Microsoft Security Response Center (MSRC). "Turning on EMET for the core Office applications will enable a number of security protections called 'security mitigations'," the pair wrote in a Thursday post to the company's Security Research & Defense blog.
EMET is a tool designed for advanced users, primarily enterprise IT pros, that manually enables ASLR (address space layout randomization) and DEP (data execution prevention) for specific applications. ASLR and DEP are two anti-exploit technologies included with Windows.
On Tuesday, Adobe confirmed that attackers were exploiting an unpatched bug in Flash Player by sending potential victims malicious Microsoft Excel documents.
Excel is the spreadsheet bundled with the Office suite.
According to Roths and Chu, Excel 2010, the version included with Office 2010, is not susceptible to the attacks now in circulation because that edition of the spreadsheet has DEP enabled. "The current attacks do not bypass DEP," they said.
Excel 2010 further protects users by isolating malicious files inside Office 2010's "Protected View," a "sandbox" that prevents attack code from escaping the application.
But people running older versions of Excel -- including the versions in Office 2007 and 2003 -- are not protected by DEP or Protected View.
Microsoft has recommended EMET before as a stop-gap defense when Adobe zero-days have hit the street. In September 2010, Microsoft told users to configure EMET to block attacks exploiting a then-unfixed flaw in Adobe Reader.
EMET 2.0 is a free download available from Microsoft's site. After downloading and installing EMET, users must manually configure the tool to add protection to Office's applications, Excel included, and perhaps their browser(s) as well.
Adobe plans to patch the Flash Player vulnerability sometime next week.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts