• Word’s DDEAUTO field considered harmful

    Posted on October 10, 2017 at 07:31 CDT by • Comment in the Forums

    Wow. This one goes all the way back to Hacker’s Guide to Word for Windows — which was published in 1994.

    Etienne Stalmans and Saif El-Sherei at Sensepost have publicized the {DDEAUTO} field’s unruly behavior. What they say is true — if you open a Word doc that contains a {DDEAUTO} field, and you click through the warnings, arbitrary code can be executed. That’s as it was designed.

    They miss one important point, though. If you open a DOCX that comes from the internet, at least with a bone-stock Word installation, you have to click the “Enable Editing” button before you see the other two warning dialogs.

    Everything old is new again….

    Office Patches/Security
DON'T MISS OUT!
Subscribe to the Free Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

View the Forum

  • Recent Replies
  • My Replies
  • My Active Topics
  • New Posts in the Last day
  • Private Messages
  • Knowledge Base
  • How to use the Forums
  • All Forums

    • Recent Topics

    My Profile

    April 2025
    S M T W T F S
     12345
    6789101112
    13141516171819
    20212223242526
    27282930  

    Remembering Woody

     

    Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.

    Mastodon profile for DefConPatch
    Mastodon profile for AskWoody

     

    Home • About • FAQ • Posts & Privacy • Forums • My Account
    Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts

    Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.