exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ms.office.ole.samples.txt

ms.office.ole.samples.txt
Posted Aug 17, 1999
Authored by MacInTouch

Micrsoft Office/OLE security holes: Does Microsoft know that they are themselves vulnerable though? "clueserver.microsoft.com" is a non-existent host???

tags | exploit
SHA-256 | eb5d4e2e79c9fa1378808210f19e43864dcfe945447331401fbe908e8c8936c4

ms.office.ole.samples.txt

Change Mirror Download
http://www.macintouch.com/o98securitysamp.html



Office 98 Security Hole: Samples

Microsoft/Compaq Samples
Reader Experiences



In researching the long-standing Microsoft Office/OLE security holes, we took a look at some of Microsoft's own Word
documents, published on its web site long after the release of its security patch, as well as a Word document posted by
Compaq on its web site. These documents, like millions of other MS Office documents, contain extraneous data that
may unintentionally reveal sensitive confidential or private information, hidden from view within Word.

A MacInTouch reader who pointed out one of the files wrote:

"You can easily read the name and directory path of the original file, any revisions and who did them
with full directory paths (even on the MS server), the directory paths of all attached graphics, and what
appears to be a registration numbers and passwords associated with each user that saved the file.
With enough documents, you could concievably construct a full directory structure for the entire MS
network, and have the machine codes to mimic a computer in the building. Looks like MS has done half
of the hacker's work for them... they are a break-in waiting to happen."

In each example below, we show hidden information that is invisible within Word but readily available when the
document is opened with a text editor or utility program, such as John Lamb's TextBrowser or Bare Bones Software's
BBEdit. We did not do an detailed security analysis of each document, but simply copied out some interesting hidden
material. In each case, it is unlikely that the document authors intended to reveal the hidden information in these files,
which now are available to millions of people on the Internet, although this information appears far more innocuous than
the URLs, source code directories, credit card information and private mail that readers report finding hidden in their
Word documents.



MSIE 4.5 Reviewers Guide

The names "Linda Sorenson" and "Brian Hodges" do not appear anywhere in the document, when you are using
Microsoft Word, nor do the file names and directories. "Dani Baldwin" is visible if you choose the "Properties" menu
item and view Summary, but it does not appear if you ask Word to "Find" the text.

Dani Baldwin
Microsoft Word 8.0
D:\briansnap\more\Picture 5.GIF
D:\briansnap\more\Picture 4.GIF
D:\briansnap\Picture 2.GIF
D:\briansnap\Picture 3.GIF
Microsoft Internet Explorer 4
Dani Baldwin
Linda Sorensonn2ndMicrosoft Word 8.0E
Waggener Edstrom
Microsoft Internet Explorer 4
D:\briansnap\more\tcrop.gif
D:\briansnap\Picture 55.gif
D:\briansnap\more\Picture 5.GIF
D:\briansnap\more\Picture 4.GIF
D:\briansnap\Picture 2.GIF
D:\briansnap\Picture 3.GIF2
D:\briansnap\more\textclup.gif
D:\briansnap\more\explorer.gif
D:\briansnap\more\favs.gifz!D:\briansnap\more\Picture 16.GIF
D:\briansnap\more\printopt.gif
D:\briansnap\more\Picture 21.GIF
D:\briansnap\more\Picture 20.GIF
D:\briansnap\Picture 56.gif
D:\briansnap\more\Picture 23.GIF
D:\briansnap\more\Picture 2.GIF
D:\briansnap\Picture 6.GIF
D:\briansnap\more\explorer.gif
D:\briansnap\more\favs.gif
D:\briansnap\more\Picture 16.GIF
D:\briansnap\more\printopt.gif
D:\briansnap\more\Picture 21.GIF
D:\briansnap\more\Picture 20.GIF
D:\briansnap\Picture 56.gif
D:\briansnap\more\Picture 23.GIF
D:\briansnap\more\Picture 2.GIF
D:\briansnap\Picture 6.GIF
Dani Baldwin&\\WE-OR2\PROD\MS\BSD\Desktop\MIERG.doc
Dani Baldwin&\\WE-OR2\PROD\MS\BSD\Desktop\MIERG.doc
Dani Baldwin=\\WE-OR2\DATA\dbaldwin\winword\AutoRecovery save of MIERG.asd
Dani Baldwin=\\WE-OR2\DATA\dbaldwin\winword\AutoRecovery save of MIERG.asd
Dani Baldwin=\\WE-OR2\DATA\dbaldwin\winword\AutoRecovery save of MIERG.asd
Dani Baldwin=\\WE-OR2\DATA\dbaldwin\winword\AutoRecovery save of MIERG.asd
Dani Baldwin=\\WE-OR2\DATA\dbaldwin\winword\AutoRecovery save of MIERG.asd
Linda SorensonC:\windows\TEMP\MIERG.doc
Brian Hodges#C:\WINDOWS\Desktop\MIERG 120898.doc
Linda Sorenson?\\WE-WA2\DATA\LindaS\Macintosh\Press materials\MIERG 120898.doc



MSIE/OE 4.5 Innovation

This example shows information leaks similar to those of the previous example:

\\Macbu\public\maclogo\Maclarge.gif
Prill$C:\WINDOWS\TEMP\MacInnovations22.doc
Linda Sorenson\\WE-WA2\DATA\LindaS\MacInnovations22.doc
Dani Baldwin\\WE-OR2\PROD\MS\BSD\Desktop\InnovaPR.doc
Dani Baldwin\\WE-OR2\DATA\dbaldwin\winword\AutoRecovery save of InnovaPR.asd
Dani Baldwin C:\temp\AutoRecovery save of InnovaPR.asd
Dani Baldwin C:\TEMP\AutoRecovery save of InnovaPR.asd
Linda Sorenson \\WE-WA2\DATA\LindaS\Macintosh\Press materials\InnovaPR.doc
Brian Hodges C:\WINDOWS\Desktop\InnovaPR new.doc
Linda Sorenson
C:\windows\TEMP\InnovaPR.doc
Linda Sorenson9\\WE-WA2\DATA\LindaS\Macintosh\Press materials\Innova.doc
Microsoft Internet Explorer 4
Linda Sorenson



MSIE 4.5 Fact Sheet

Here we can identify some new people involved in the project, although their names, too, are invisible within
Microsoft Word. Note also the presence of the "GUID" fingerprint:

_PID_GUID_PID_HLINKSAN{2DD3214D-64E7-11D2-9002-0000C0657DF9
\\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
\\Macbu\public\maclogo\macsmal2.gif
Baldwin\\WE-OR2\PROD\MS\BSD\Desktop\4.5IEFS.doc
Jodi Ropert C:\WINDOWS\TEMP\4.5IEFS.doc
Jodi Ropert C:\WINDOWS\TEMP\4.5IEFS.docDani Baldwin\\WE-OR2\DATA\dbaldwin\winword\AutoRecovery save
of 4.5IEFS
Christina Snavely \\WE-OR2\PROD\MS\BSD\Desktop\4.5IEFS.doc
Linda Sorenson:\\WE-WA2\DATA\LindaS\Macintosh\Press materials\4.5IEFS.doc
Brian Hodges C:\WINDOWS\TEMP\AutoRecovery save of 4.asd
Brian Hodges"C:\WINDOWS\Desktop\4.5IEFS new.doc
Linda Sorenson \\WE-WA2\DATA\LindaS\Macintosh\Press materials\4.5IEFS new.doc



Compaq Modem Overview

In the Word document posted by Compaq, we again find the name of the author, even though he is not listed in the
Properties sheet, plus his file and directory names and the GUID information:

Greg Bretting%C:\My Documents\modem white paper.doc
Greg Bretting%C:\My Documents\modem white paper.doc
Greg Bretting%C:\My Documents\modem white paper.doc
Greg Bretting%C:\My Documents\modem white paper.doc
Greg Bretting%C:\My Documents\modem white paper.doc
Greg Bretting%C:\My Documents\modem white paper.doc
Greg Brettin %C:\My Documents\modem white paper.doc
Greg Bretting:C:\WINDOWS\TEMP\AutoRecovery save of modem white paper.asd
Terry Durham%C:\My Documents\modem white paper.doc
C:\S&S_dataprep\White Papers\NEW\prt005a0798.doc
_PID_GUID_PID_HLINKSAN{EB8A944A-2068-11D0-BD46-00AA00A42EA1}Al
C:\cpq_logo\REDCPQSM.BMP





More MacInTouch Reader Experiences

From: [MacInTouch reader]
Subject: word98 security issue, it's bigger than you think.
Date: Wed, 10 Mar 1999

I have to remain anonymous about this please, because of the implications this might have.

I am a developer and I occasionally use word98 for reports and such. Reading your report yesterday
about the security issue, I wanted to see if it was true. I opened one of my old word docs in codewarrior
(after changing the file type/creator codes ) and found the there were not only directory listings to
source code I was working on at the time, but also names of specific functions within the source. These
things were not menitioned anywhere within the document I typed, but they are embedded in my file. I
can supply you with the file if you like, but I'd rather not because it has my name in it and I think the
reprecussions of this could be rather large. If you have any questions about this, feel free to send them
to me.





Date: Wed, 10 Mar 1999 12:04:01 -0500
From: Joe Gudac
Organization: Gudac Bowling Lanes
Subject: Word Info

Ric,

After reading about all these problems with the info Word stores with it's files I decided to look at
some of the files I had for my business. I picked a simple file that only had my business letterhead and
address info and business tax id numbers that I had to give to our bank recently.

When looking at the file in canopener I was astonished to find that the file had information from other
files containing my credit card numbers and personal information about myself and my family.

I have tried for the past several years to not be a Microsoft basher and have tried to learn as much
about their software applications to keep myself up to date with the standard business technology, but
this is absurd. This along with some of the testimony that has been presented in their anti trust trial I
am terrified that they are big brother and may be more corrupt than our government. If that isn't a scare.

Enjoy your information and keep up the great web site.

Regards,

Joseph J Gudac Jr





Date: Mon, 15 Mar 1999
From: [MacInTouch reader]
Subject: WORD SECURITY

*** Please keep the following anonymous:

I too have stopped defending Microsoft.

I work for a *major* Internet company at a fairly high level. This morning I too looked at a report I
submitted last week using Notepad. Not ONLY did it have my name and directories on my hard drive,
but it had information on OTHER applications that are totally unrelated to MS Word in it! These apps
are competitors of MS (not that many aren't these days). BUT I think the most disturbing was this: all
my reports have the same filename except for the date (contained in the filename too). The paths to
EVERY report in that directory were there too.

In a world where the economoy is changing (mostly for the better I like to think) it's SAD to think
actions like these undermine the trust people place in companies that work hard. People should be
empowered and educated about technology, not intimidated and afraid because of it. I believe Microsoft
is validating a LOT of people's fears about privacy and security unnecessarily.

--- Concerned.





Date: Mon, 15 Mar 1999 10:52:00 -0500 (EST)
From: Oj Ganesh
To: MacInTouch
Subject: Microsoft security

I read with interest your stories and updates concerning GUID numbers and other personal informaion
being found in documents created by microsoft programs. Thanks for all the updates and keeping with
the story.

Yesterday I finally got around to removing some original software that my imac came with, when I
noticed a control panel called "Configuration Manager". In it was a section called "Cookies", which
(when clicked on) displayed *Some* cookies on my system. Two of the cookies immediately caught my
attention since I had never visited the sites with my imac. They were: microsot.com and msn.com, they
both had the name "MC1" and they were 'enabled'. Double clicking on the cookies brought up the
Cookie Properties box which had this shocking line: "Value: GUID=(my GUID presumably)". I couldn't
believe it! Both cookies were identical (both were also set to expire on "Expires: Wed, Sep 15, 1999
7:00 PM GMT") in every respect.

The "Configuration Manager" control panel is apparetly made by Microsoft (as the about box says)...

Thanks, keep up the good (Mac) work,
-Oj





Date: Mon, 15 Mar 1999 11:10:49 -0600

To: notes@macintouch.com

From: [MacInTouch reader]

Subject: Microsoft Security Issues

Ric,

This may have been reported prior, and it may be less intrusive than the Microsoft issues, but we seem
to be ignoring the fact that many other applications besides those from Microsoft carry artifacts from
files unrelated to the current one. For the most part these are data that we'd rather not be seen by
others.

At the moment, I'm referring specifically to Adobe PageMaker. PageMaker files opened in Can Opener
reveal lots of extraneous data - directory paths, hard drive names, file names that appear to be
unrelated to the current file, and perhaps references to other sensitive data. These are data that are not
visible and cannot be found or expunged by any normal means. In addition to embedding directory paths,
filenames, etc., related to the current file, it seems that whenever you do a "save as" in PageMaker a
lot of data from the original file become permanent and reside in that and all future iterations, or saved
as versions, of that file. The data can compound to become an interesting record in its own right.

Lots of folks transfer lots of data in the form of PageMaker files and I'll wager that few of them are
aware of the nature of some of the data they're "making public" when they do.

Maybe some of the more experienced (than me) sleuths will care to comment on PageMaker too?





Date: Mon, 15 Mar 1999 12:54:31 -0500
Subject: Word Privacy Problems
From: "Jeremy LaCivita"
To: notes@macintouch.com

Unbelievable!

After reading your section on Word privacy issues, I opened up a paper I wrote last week in BBEdit. In
addition to a bunch of paths on my machine (which is somewhat understandable) i found addresses of
all the sites I had visited that night (using Internet Explorer):

3Com/Palm Computing - Macintosh

The Apple Store (U.S.)

The Apple Store (U.S.)

In other documents I found information about my email account like my mail server. Who knows what
other information is hidden in the document mixed in with all of the gibberish.

This really bothers me! The paths to images used in the file in somewhat understandable and relevant,
but this is completely irrelevant, and I really think Microsoft needs to explain themselves.

Jeremy





Date: Tue, 16 Mar 1999 01:46:52 +0100
Subject: word98 security - history recorded
From: altair@bigfoot.de
To: notes@macintouch.com

Encouraged by the interesting reports about security problems in word98 docs I carefully examined
some of my files with a text editor.

Guess what. The complete history of some documents I've been using since one year has been
recorded in the file (different OS versions, different machines to be identified by their owner's names
and different hierachical file structures were all plainly visible).

Obviously previous versions of word (at least word 6) own this special "recording feature", too. Isn't it
nice? Thank you, Big Bill, this is exactly what users needed most.





Date: Mon, 15 Mar 1999 13:05:59 -0700
Subject: Word98
From: "Kanton Budge"
To: notes@macintouch.com

This is absolutely atrocious! I opened a few Word 98 documents I wrote some weeks ago related to my
business. It contained information from cookies found in Internet Explorer about sites I've visited that
day. I also copy and pasted information from an email sent to me via Outlook Express 4.5 into a word
document and found links to information about web links!

This is extremely serious. I could take a document sent to me from a potential employee or business
associate and find out what their registered Office 98 name is, what web sites they've visited, and
potentially what email addresses are related to them!
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close