Excel gets a variation of the Word DDE block settings

Topic

New Reply

They come along for the ride with this month’s Excel security patches — but Microsoft didn’t bother to document any of it, outside of an addendum to
[See the full post at: Excel gets a variation of the Word DDE block settings]

2 users thanked author for this post.

Elly, MrBrian

Reply | Quote

Replies

Increasingly, it seems that security vulnerabilities are being addressed through disabling the functionality an exploit might utilize for an attack. Perhaps I am overstating the case but the cyberattack hysteria we are all living with is inevitably reducing the throughput and functional features of our systems/software. The move by MS to cumulative rollups leaves us with the quandary to accept the downsides or stop patching entirely. I am starting to wonder if and when it will be time to step off this train.

2 users thanked author for this post.

Bill C., Karlston

Reply | Quote

Mostly agree with you, EXCEPT that much of this functionality should NEVER have been enabled by default in the first place.

Those who really want and need some particular functionality would soon figure out how to enable it. The rest of us would NEVER have to deal with it, and naive users would never, EVER, be put at risk by security flaws in a feature they didn’t even know existed!

2 users thanked author for this post.

Elly, PKCano

Reply | Quote

“All of this came as quite a surprise to me because Microsoft didn’t bother to document any of it in this month’s security bulletins. Instead, the description has been added to last year’s Security Advisory 170021.”

Microsoft can send you email notifications for things like this. See Microsoft Technical Security Notifications. An alternative source: http://seclists.org/microsoft/. For example, this was the notification that Microsoft sent about the change in the security advisory mentioned above.

1 user thanked author for this post.

Jan K.

Reply | Quote

Microsoft Security Advisory 4053440: Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields is now at v3.0

Reply | Quote

From Reviving DDE: Using OneNote and Excel for Code Execution: “TL;DR: You can achieve DDE execution with Excel SpreadSheets embedded within OneNote. This bypasses the original Excel mitigation ruleset (Microsoft has released a patch to properly mitigate this) as well as the Protected View sandbox”

Reply | Quote