Microsoft released its new Microsoft Office Isolated Conversion Environment (MOICE), which uses Microsoft Office's system converters to convert Office 2003's binary format files into the Office Open XML format used by Office 2007. The purpose of MOICE is to help strip out potentially dangerous code that attackers might have inserted in Office files. MOICE works with .doc, .ppt, .pot, .pps, .xls, .xlt, and .xla file formats.
Because MOICE needs to process documents in Office binary formats--which are inherently dangerous as evidenced by numerous Word, Excel, and PowerPoint document exploits--and because of the potential to exploit MOICE itself, Microsoft designed the tool to run in a restricted environment. Microsoft security guru David LeBlanc said that one step taken to help defend MOICE is that it uses restricted security tokens, which prevent any code within the documents it processes from taking actions on the local system.
"What it boils down to is that even if you do get arbitrary code running in the converter, good luck getting it to do anything very useful. The operating system [won't] prevent [an attacker] from opening a socket, but in terms of the local system, there isn't a lot [an attacker could do with such restricted access. MOICE] probably isn't perfect, but it is difficult [to exploit], and does raise the bar. An exploit that wasn't targeted directly at that sort of environment would be very unlikely to work correctly," LeBlanc said.
MOICE works in both Office 2003 and Office 2007. Using it requires that administrators install the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats.
Microsoft also published its new 2007 Office System Administrative Templates to help configure the registry on client computers to restrict which types of files a user can open or save in Office. To go along with the new templates the company released a TechNet document, "Enforce settings by using Group Policy in the 2007 Office system," as well as three new knowledge base articles (922849, 922848, and 922847) that explain how to work around end-user errors that occur with the new group policies in place.