19 ms·

Microsoft Office – OLE Packager allows code execution in all Office versions

96 points by tomtoise 11y ago

orionblastar 11y ago
But the old versions of Office won't get patched only 2007 and above, right? All the more reason to use OpenOffice.Org or LibreOffice.
- deleted 11y ago
  [deleted]
- therobot24 11y ago
  Apple stopped patching Leopard (released in 2007) by 2011 and stopped supporting IOS 5 (released in 2011) just this year. Google is just starting to ditch support for Ice Cream Sandwich (released in 2011). Why should Microsoft continue to support office below 2007?
  - toyg 11y ago
    "From great power comes great responsibility." - Benjamin "Ben" Parker, 1962
    - joshuapants 11y ago
      "Computers give the user great power, so it's the user's responsibility to keep software up to date instead of relying on ancient packages." - Me, applying that logic to this situation, 1435872794 seconds since Jan 01 1970
  - orionblastar 11y ago
    Some companies cannot afford to upgrade their hardware to run the latest versions. They are stuck on older Windows versions that cannot run the latest Office versions. I noticed a lot of companies still stick with XP. I watched the Terminator Genisys movie and had a display in the hallway with a pop-up that said XP support has ended. A lot of Movie Theaters use XP still. The US Navy still uses XP and an old version of Office.
    - cmdrfred 11y ago
      "We can't afford it" is the mating call of the business owner/MBA. I've worked for ten companies over the course of my life (small business to mid size), none of them could ever afford anything (unless it was a vacation or a luxury vehicle). The fact is they don't want to spend any money and expect Microsoft to honor their $120 office purchase with free updates for the next few centuries. Fuck em, they can pay or get there data stolen by Chinese teenagers.
      - orionblastar 11y ago
        Some are small businesses that cannot afford to upgrade their PCs and are barely getting by. I've done tech support for people still on XP, 2000, and Vista. I think if they run Vista they got a good chance to buy Windows 10 Pro for $164 but it will break compatibility with their Office Software and force them to do a fresh install. A lot of business software is written for older versions of Office. I tried to make a Virtual Machine creating service if a company has the licenses I can make a Virtual Box or QEMU virtual machine with the old version of Windows and Office in it if they give me their license keys and pay me for their labor. But nobody wants to do that yet. I plan on running Linux on my main box at home and run Windows in virtual machines if Windows 10 ends up being buggy as all heck.
        cmdrfred 11y ago
        They will go out of business in a few years because they failed to adapt, and we won't really miss them. If they 'can't afford' $164 once a decade what are they paying their employees? Certainly not a living wage. So they have high churn and nobody working there really cares about the business, its just another low paying job and unemployment is falling. These companies are mismanaged, they didn't budget when times were good for when things go south. I feel no pity when someone has to adjust their standard of living to a level that the majority of the planet would die for. Don't fall for the sob stories, its there so they take home more of the profits that you generated. Instead build a start up and blow their antiquated business model out of the water. Related Protip: If you go to a bank/doctors office or anywhere else that wants a large amount of personal data from you, don't give it to them if they are still running XP. (If enough people did this all of the sudden it would become affordable)
- cwyers 11y ago
  Does LibreOffice give security patches for eight-year-old versions of LibreOffice?
  - nothrabannosir 11y ago
    No, but I can. I say this as an unapologetic user of all software closed source, Windows, Office, et al. I send files in .docx without asking if my peers even have Windows. I use Google Maps and closed source everything everywhere always. But, even I cannot deny: if this were open source, many of the points leading up to this bug could be addressed without any help from the vendor.
    - nemothekid 11y ago
      >No, but I can. I'm not sure thats fair. Yes you can, but I'm guessing you aren't the type of person to be caught running software 7 years after its EOL. Or put it this way, Office 2003 was discontinued in 2007. Thats like running Debian 3.1 today (Sarge, 5 stable releases ago), and complaining about continued support. RHEL2.1 was EOL'd in 2008 (RHEL6 is the "old guard" now). If you wouldn't expect continued support for Debian 3.1 or RHEL2.1 in 2015 there's, I don't see why its a problem for Microsoft or how it makes open source any better. Sure, yes you could patch Debian 3.1 yourself, but ultimately how fruitful is this effort, and how many people can be expected to to write kernel patches? Even if Microsoft said tomorrow Office 2003 was open source, how many individuals could you expect to have the know to patch their installations?
  - davidgerard 11y ago
    Yes, a whole new version free ;-p
    - singold 11y ago
      That runs on the same old hardware
      - davidgerard 11y ago
- andzt 11y ago
  All pre-2007 versions have been end of life/support for a while now. So yes.
deleted 11y ago
[deleted]
orf 11y ago
If this is true then it's a huge mess: - They used a static list of file extensions to blacklist - This hasn't been kept up to date, powershell scripts are automatically executed - There is no way to disable it - Embedded files are executed within a trusted directory I'm guessing Microsoft has to tread very lightly when messing with OLE, I bet a lot of legacy software from large Microsoft customers uses it.
- EvanAnderson 11y ago
  I didn't see anything in that post to give me the feeling that code is being executed automatically. While I would concede that requiring the user to click on something inside the "payload" document isn't a high bar to achieve it is different than automatic code execution upon opening the document.
  - gossitd 11y ago
    It needs user interaction. POC Samples here: http://owned.lab6.com/~gossi/research/public/packager/ http://owned.lab6.com/~gossi/research/public/packager/ (made by me, safe to try).
- UnoriginalGuy 11y ago
  > This hasn't been kept up to date, powershell scripts are automatically executed Powershell won't execute AT ALL by default. You have to enable execution. And it certainly won't execute automatically, the user has to click to run.
- r00fus 11y ago
  Legacy software and installations should be no excuse to be bug compatible to this level for recent versions and patches.
tdicola 11y ago
I've love to know a scenario where OLE is actually used today. It might have made sense in the early 90's pre-Internet & HTML computer world but really has no use today and is just a massive security hole. Seems like it should have just been completely removed (see also Vista's desktop gadgets, which were actually removed and disabled after realizing they were a huge security issue too).
- EvanAnderson 11y ago
  I don't know how much it shares w/ OLE compound documents, but OLE for Process Control (OPC, now retroactively renamed to "Open Platform Communications") is very common in multi-vendor SCADA environments.
  - testrun 11y ago
    It has a common ancestry, but OPC moved on. They are now using OPC-UA. And the usage is totally different. In OPC you do not imbed one app in another, it is a standardised protocol to get data from DCS/SCADA. But they did use DCOM up until OPC V 3.
- stephengillie 11y ago
  The basic idea was great - copy some cells out of Excel and paste them into Word. You can put your sales statistics into your end-of-quarter report. Then they added linking, so when the spreadsheet was updated, your report would update too. So you could make the report early, let Accounting update the spreadsheet, then just let the report auto-update. I'm pretty sure Outlook uses the Word rendering engine. And dragging documents into Outlook is one of the ways to attach/embed a file into the email. So I'm pretty sure this still leverages that code. I'm actually guessing this is almost everywhere. Maybe it didn't get put into Vista (where a number of security enhancements like the 2-level model aka UAC elevation got made) but it's still all over Office. I wonder if IE is impacted.
  - so0k 11y ago
    or link to the latest covers to make sure they are always up to date. no longer need to worry about those memos, wouldn't that be great?
UnoriginalGuy 11y ago
> The DLL file hasn't been kept up to date. For example, you can use .PS1 (PowerShell) embeds without any security warning. There's a lot of file types now you can execute code with without warning, basically. That's a poor example. Powershell scripts won't execute by default at all, and a lot of enterprise customers will only execute scripts signed by the internal CA. Off the top of my head I cannot think of too many new ways of running executable code. Microsoft has only been removing them, not adding news ones. Powershell is one of the few new ones and is designed from the ground up expressly not to allow this type of thing.
- scott_karana 11y ago
  Originally, Powershell did NOT have execution policy. And even in versions that do, it's also at the mercy of the invoking process, as I recall. Which is why he specifically said "powershell embeds without any security warning", I suspect. :| https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ https://blog.netspi.com/15-ways-to-bypass-the-powershell-exe...
  - hug 11y ago
    On an OS that is still under Microsoft support, all of those "bypasses" require: A) An argument to powershell.exe which Office will not supply when executing the ps1 file or B) Interacting with the powershell window after it's opened (which you can't do without already having some sort of code execution) or C) The execution policy being set to something that allows unsigned code. A and B are impossible, and C can be locked down with group policy to the point that local administrator rights can't bypass. Executing a ps1 with the appropriate parameters after executing something else may be possible, but also redundant.
  - x0n 11y ago
    PowerShell execution policy is not a security layer/boundary. It's just a simple mechanism to stop people unintentionally shooting themselves in the foot; it won't stop other people intentionally shooting you in the foot.
  - useerup 11y ago
makomk 11y ago
Wow, this takes me back. I remember getting in trouble at school as a kid for using this to attach executable code to e-mails and bypass all the warnings and filters. That must've been, ooh, about a decade and a half ago now. I'm shocked it still works in our modern security-aware age.
RKearney 11y ago
For those of you worried about this, I tested it at work and it was blocked by our Software Restriction Policy that I put in place just a few weeks ago. The execution of %TEMP%\PAYLOAD.EXE was blocked. I highly urge everyone to deploy a strong Software Restriction Policy in whitelist mode. It catches everything we've thrown at it so far.
- stephengillie 11y ago
  I didn't know this was available until now. Another tool for the toolbox!
- huhtenberg 11y ago
  There's also AppLocker in W7+ : https://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%29.aspx https://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%... and I would guess it's very closely related to SRP - https://technet.microsoft.com/en-us/library/ee424371%28v=ws.10%29.aspx https://technet.microsoft.com/en-us/library/ee424371%28v=ws....
- gossitd 11y ago
  hi, I wrote the advisory. Here's some POC I just published here: http://owned.lab6.com/~gossi/research/public/packager/ http://owned.lab6.com/~gossi/research/public/packager/ The SalesOrder.rtf file is safe to try at work. All it does is lock your workstation. It should work behind Software Restriction Policy and Microsoft AppLocker (and Citrix Application thingy).
  - RKearney 11y ago
    The RTF opened a zip folder with a .js file in it. Attempting to open it with the default Windows Based Script Host results in a dialog box from Software Restriction Policy stating that execution was blocked.
- reiichiroh 11y ago
  Would someone renaming the payload to a filename of something that's whitelisted defeat the whitelist?
girvo 11y ago
This is how I used to get around Novell NetWare in high-school to run compilers and learn programming. Funny to see it still exists.
cesarb 11y ago
Does the same exploit work on Wine? It has its own implementation of packager.dll, which doesn't seem to have any blacklist. What happens if for instance Wine is being used to run Microsoft Office?
drsim 11y ago
Ha, I didn't know this still existed. I 'hacked' our school PCs running Windows 3.11 using this technique. The sysadmin locked down every possible way to run executables apart from those he exposed in Program Manager. Of course, everyone had Word. Simply embedding an OLE object let me run any exe.
callesgg 11y ago
Someone still needs to click the thing to execute it. Clicking any executable in windows will launch it. I really can't see the difference that makes this so bad. User clicks executable in office it launches.... vs User clicks executable in explorer(or other software) it launches....
- nikbackm 11y ago
  So there is no way to get the executable to auto-execute when you open the document that embeds it?

96 points by tomtoise 11y ago

But the old versions of Office won't get patched only 2007 and above, right? All the more reason to use OpenOffice.Org or LibreOffice.

deleted 11y ago
[deleted]
therobot24 11y ago
Apple stopped patching Leopard (released in 2007) by 2011 and stopped supporting IOS 5 (released in 2011) just this year. Google is just starting to ditch support for Ice Cream Sandwich (released in 2011). Why should Microsoft continue to support office below 2007?
- toyg 11y ago
  "From great power comes great responsibility." - Benjamin "Ben" Parker, 1962
  - joshuapants 11y ago
    "Computers give the user great power, so it's the user's responsibility to keep software up to date instead of relying on ancient packages." - Me, applying that logic to this situation, 1435872794 seconds since Jan 01 1970
- orionblastar 11y ago
  Some companies cannot afford to upgrade their hardware to run the latest versions. They are stuck on older Windows versions that cannot run the latest Office versions. I noticed a lot of companies still stick with XP. I watched the Terminator Genisys movie and had a display in the hallway with a pop-up that said XP support has ended. A lot of Movie Theaters use XP still. The US Navy still uses XP and an old version of Office.
  - cmdrfred 11y ago
    "We can't afford it" is the mating call of the business owner/MBA. I've worked for ten companies over the course of my life (small business to mid size), none of them could ever afford anything (unless it was a vacation or a luxury vehicle). The fact is they don't want to spend any money and expect Microsoft to honor their $120 office purchase with free updates for the next few centuries. Fuck em, they can pay or get there data stolen by Chinese teenagers.
    - orionblastar 11y ago
      Some are small businesses that cannot afford to upgrade their PCs and are barely getting by. I've done tech support for people still on XP, 2000, and Vista. I think if they run Vista they got a good chance to buy Windows 10 Pro for $164 but it will break compatibility with their Office Software and force them to do a fresh install. A lot of business software is written for older versions of Office. I tried to make a Virtual Machine creating service if a company has the licenses I can make a Virtual Box or QEMU virtual machine with the old version of Windows and Office in it if they give me their license keys and pay me for their labor. But nobody wants to do that yet. I plan on running Linux on my main box at home and run Windows in virtual machines if Windows 10 ends up being buggy as all heck.
      - cmdrfred 11y ago
        They will go out of business in a few years because they failed to adapt, and we won't really miss them. If they 'can't afford' $164 once a decade what are they paying their employees? Certainly not a living wage. So they have high churn and nobody working there really cares about the business, its just another low paying job and unemployment is falling. These companies are mismanaged, they didn't budget when times were good for when things go south. I feel no pity when someone has to adjust their standard of living to a level that the majority of the planet would die for. Don't fall for the sob stories, its there so they take home more of the profits that you generated. Instead build a start up and blow their antiquated business model out of the water. Related Protip: If you go to a bank/doctors office or anywhere else that wants a large amount of personal data from you, don't give it to them if they are still running XP. (If enough people did this all of the sudden it would become affordable)
cwyers 11y ago
Does LibreOffice give security patches for eight-year-old versions of LibreOffice?
- nothrabannosir 11y ago
  No, but I can. I say this as an unapologetic user of all software closed source, Windows, Office, et al. I send files in .docx without asking if my peers even have Windows. I use Google Maps and closed source everything everywhere always. But, even I cannot deny: if this were open source, many of the points leading up to this bug could be addressed without any help from the vendor.
  - nemothekid 11y ago
    >No, but I can. I'm not sure thats fair. Yes you can, but I'm guessing you aren't the type of person to be caught running software 7 years after its EOL. Or put it this way, Office 2003 was discontinued in 2007. Thats like running Debian 3.1 today (Sarge, 5 stable releases ago), and complaining about continued support. RHEL2.1 was EOL'd in 2008 (RHEL6 is the "old guard" now). If you wouldn't expect continued support for Debian 3.1 or RHEL2.1 in 2015 there's, I don't see why its a problem for Microsoft or how it makes open source any better. Sure, yes you could patch Debian 3.1 yourself, but ultimately how fruitful is this effort, and how many people can be expected to to write kernel patches? Even if Microsoft said tomorrow Office 2003 was open source, how many individuals could you expect to have the know to patch their installations?
- davidgerard 11y ago
  Yes, a whole new version free ;-p
  - singold 11y ago
    That runs on the same old hardware
    - davidgerard 11y ago
andzt 11y ago
All pre-2007 versions have been end of life/support for a while now. So yes.

deleted 11y ago

[deleted]

orf 11y ago

If this is true then it's a huge mess: - They used a static list of file extensions to blacklist - This hasn't been kept up to date, powershell scripts are automatically executed - There is no way to disable it - Embedded files are executed within a trusted directory I'm guessing Microsoft has to tread very lightly when messing with OLE, I bet a lot of legacy software from large Microsoft customers uses it.

EvanAnderson 11y ago
I didn't see anything in that post to give me the feeling that code is being executed automatically. While I would concede that requiring the user to click on something inside the "payload" document isn't a high bar to achieve it is different than automatic code execution upon opening the document.
- gossitd 11y ago
  It needs user interaction. POC Samples here: http://owned.lab6.com/~gossi/research/public/packager/ http://owned.lab6.com/~gossi/research/public/packager/ (made by me, safe to try).
UnoriginalGuy 11y ago
> This hasn't been kept up to date, powershell scripts are automatically executed Powershell won't execute AT ALL by default. You have to enable execution. And it certainly won't execute automatically, the user has to click to run.
r00fus 11y ago
Legacy software and installations should be no excuse to be bug compatible to this level for recent versions and patches.

tdicola 11y ago

I've love to know a scenario where OLE is actually used today. It might have made sense in the early 90's pre-Internet & HTML computer world but really has no use today and is just a massive security hole. Seems like it should have just been completely removed (see also Vista's desktop gadgets, which were actually removed and disabled after realizing they were a huge security issue too).

EvanAnderson 11y ago
I don't know how much it shares w/ OLE compound documents, but OLE for Process Control (OPC, now retroactively renamed to "Open Platform Communications") is very common in multi-vendor SCADA environments.
- testrun 11y ago
  It has a common ancestry, but OPC moved on. They are now using OPC-UA. And the usage is totally different. In OPC you do not imbed one app in another, it is a standardised protocol to get data from DCS/SCADA. But they did use DCOM up until OPC V 3.
stephengillie 11y ago
The basic idea was great - copy some cells out of Excel and paste them into Word. You can put your sales statistics into your end-of-quarter report. Then they added linking, so when the spreadsheet was updated, your report would update too. So you could make the report early, let Accounting update the spreadsheet, then just let the report auto-update. I'm pretty sure Outlook uses the Word rendering engine. And dragging documents into Outlook is one of the ways to attach/embed a file into the email. So I'm pretty sure this still leverages that code. I'm actually guessing this is almost everywhere. Maybe it didn't get put into Vista (where a number of security enhancements like the 2-level model aka UAC elevation got made) but it's still all over Office. I wonder if IE is impacted.
- so0k 11y ago
  or link to the latest covers to make sure they are always up to date. no longer need to worry about those memos, wouldn't that be great?

UnoriginalGuy 11y ago

> The DLL file hasn't been kept up to date. For example, you can use .PS1 (PowerShell) embeds without any security warning. There's a lot of file types now you can execute code with without warning, basically. That's a poor example. Powershell scripts won't execute by default at all, and a lot of enterprise customers will only execute scripts signed by the internal CA. Off the top of my head I cannot think of too many new ways of running executable code. Microsoft has only been removing them, not adding news ones. Powershell is one of the few new ones and is designed from the ground up expressly not to allow this type of thing.

scott_karana 11y ago
Originally, Powershell did NOT have execution policy. And even in versions that do, it's also at the mercy of the invoking process, as I recall. Which is why he specifically said "powershell embeds without any security warning", I suspect. :| https://blog.netspi.com/15-ways-to-bypass-the-powershell-execution-policy/ https://blog.netspi.com/15-ways-to-bypass-the-powershell-exe...
- hug 11y ago
  On an OS that is still under Microsoft support, all of those "bypasses" require: A) An argument to powershell.exe which Office will not supply when executing the ps1 file or B) Interacting with the powershell window after it's opened (which you can't do without already having some sort of code execution) or C) The execution policy being set to something that allows unsigned code. A and B are impossible, and C can be locked down with group policy to the point that local administrator rights can't bypass. Executing a ps1 with the appropriate parameters after executing something else may be possible, but also redundant.
- x0n 11y ago
  PowerShell execution policy is not a security layer/boundary. It's just a simple mechanism to stop people unintentionally shooting themselves in the foot; it won't stop other people intentionally shooting you in the foot.
- useerup 11y ago

makomk 11y ago

Wow, this takes me back. I remember getting in trouble at school as a kid for using this to attach executable code to e-mails and bypass all the warnings and filters. That must've been, ooh, about a decade and a half ago now. I'm shocked it still works in our modern security-aware age.

RKearney 11y ago

For those of you worried about this, I tested it at work and it was blocked by our Software Restriction Policy that I put in place just a few weeks ago. The execution of %TEMP%\PAYLOAD.EXE was blocked. I highly urge everyone to deploy a strong Software Restriction Policy in whitelist mode. It catches everything we've thrown at it so far.

stephengillie 11y ago
I didn't know this was available until now. Another tool for the toolbox!
huhtenberg 11y ago
There's also AppLocker in W7+ : https://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%29.aspx https://msdn.microsoft.com/en-us/library/dd548340%28v=ws.10%... and I would guess it's very closely related to SRP - https://technet.microsoft.com/en-us/library/ee424371%28v=ws.10%29.aspx https://technet.microsoft.com/en-us/library/ee424371%28v=ws....
gossitd 11y ago
hi, I wrote the advisory. Here's some POC I just published here: http://owned.lab6.com/~gossi/research/public/packager/ http://owned.lab6.com/~gossi/research/public/packager/ The SalesOrder.rtf file is safe to try at work. All it does is lock your workstation. It should work behind Software Restriction Policy and Microsoft AppLocker (and Citrix Application thingy).
- RKearney 11y ago
  The RTF opened a zip folder with a .js file in it. Attempting to open it with the default Windows Based Script Host results in a dialog box from Software Restriction Policy stating that execution was blocked.
reiichiroh 11y ago
Would someone renaming the payload to a filename of something that's whitelisted defeat the whitelist?

girvo 11y ago

This is how I used to get around Novell NetWare in high-school to run compilers and learn programming. Funny to see it still exists.

cesarb 11y ago

Does the same exploit work on Wine? It has its own implementation of packager.dll, which doesn't seem to have any blacklist. What happens if for instance Wine is being used to run Microsoft Office?

drsim 11y ago

Ha, I didn't know this still existed. I 'hacked' our school PCs running Windows 3.11 using this technique. The sysadmin locked down every possible way to run executables apart from those he exposed in Program Manager. Of course, everyone had Word. Simply embedding an OLE object let me run any exe.

callesgg 11y ago

Someone still needs to click the thing to execute it. Clicking any executable in windows will launch it. I really can't see the difference that makes this so bad. User clicks executable in office it launches.... vs User clicks executable in explorer(or other software) it launches....

nikbackm 11y ago
So there is no way to get the executable to auto-execute when you open the document that embeds it?