Microsoft Office – OLE Packager allows code execution in all Office versions

Re:Microsoft Office – OLE Packager allows code execution in ... by tdicola on Thursday July 02, 2015 @05:54PM (#9821959)

I've love to know a scenario where OLE is actually used today. It might have made sense in the early 90's pre-Internet & HTML computer world but really has no use today and is just a massive security hole. Seems like it should have just been completely removed (see also Vista's desktop gadgets, which were actually removed and disabled after realizing they were a huge security issue too).

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by stephengillie on Thursday July 02, 2015 @06:00PM (#9822003)

The basic idea was great - copy some cells out of Excel and paste them into Word. You can put your sales statistics into your end-of-quarter report.

Then they added linking, so when the spreadsheet was updated, your report would update too. So you could make the report early, let Accounting update the spreadsheet, then just let the report auto-update.

I'm pretty sure Outlook uses the Word rendering engine. And dragging documents into Outlook is one of the ways to attach/embed a file into the email. So I'm pretty sure this still leverages that code.

I'm actually guessing this is almost everywhere. Maybe it didn't get put into Vista (where a number of security enhancements like the 2-level model aka UAC elevation got made) but it's still all over Office. I wonder if IE is impacted.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by julian_t on Friday July 03, 2015 @04:52AM (#9824368)

> Then they added linking

And that's great, until someone inserts a couple of rows into the range you've linked. Or moves the file. Or any one of another hundred things could happen to upset the OLE Gods.

Do not go anywhere near OLE linking... that way lies madness.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by so0k on Thursday July 02, 2015 @07:16PM (#9822380)

or link to the latest covers to make sure they are always up to date. no longer need to worry about those memos, wouldn't that be great?

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by brudgers on Thursday July 02, 2015 @07:45PM (#9822487)

In the past I've used OLE regularly for Excel spreadsheets in AutoCAD drawings. Nothing else came close in terms of ease and reliability or standardization. OLE is a powerful technology and the complaint tastes a bit like "no one should use JavaScript because of XSS" on the palette. I mean just think what malicious input can do If passed to python in the shell.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by clebio on Thursday July 02, 2015 @08:21PM (#9822611)

Specific to the Microsoft Office suite, or in general?

I spent some time trying to automation Powerpoint and Excel creation via Python, which is based vaguely on the capability: http://clebio.github.io/pythonOfficePresentation.html

Unrelated to Microsoft Office, I wrote a Perl utility that would run QXDM (telecom call testing software) via OLE in order to automate the initiation and answering of cellphone calls (think drive-testing or load-testing a cellular network). It was quite useful. Qualcomm, who licenses QXDM, had a fairly good reference document for the OLE interface to the program.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by EvanAnderson on Thursday July 02, 2015 @05:59PM (#9822000)

I don't know how much it shares w/ OLE compound documents, but OLE for Process Control (OPC, now retroactively renamed to "Open Platform Communications") is very common in multi-vendor SCADA environments.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by testrun on Thursday July 02, 2015 @07:56PM (#9822519)

It has a common ancestry, but OPC moved on. They are now using OPC-UA. And the usage is totally different. In OPC you do not imbed one app in another, it is a standardised protocol to get data from DCS/SCADA. But they did use DCOM up until OPC V 3.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by mxmauro on Thursday July 02, 2015 @09:02PM (#9822773)

Why you consider it is a huge security hole? Just because of the OLE Packager bug?

COM/DCOM, where OLE rests, can be very secure if they are properly used.

By the way, OLE is used widely mainly in Microsoft products.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by x0n on Thursday July 02, 2015 @10:24PM (#9823047)

I read the post and I don't see any "bugs" pointed out per-se.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by mxmauro on Thursday July 02, 2015 @11:33PM (#9823282)

I'm asking about the security issues. Although they usually implies bugs the only one I mentioned is the OLE packager one that generated a big security problem.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by nickpsecurity on Sunday July 05, 2015 @02:15PM (#9834355)

Might be misremembering, but I think there's a variant of it used heavily in industrial automation (eg factories). It was a standard that you had to buy for a significant sum of money. The friend in embedded design that told me didn't like it but many groups used it. Can't remember what it's called...

Past that, it's probably just there to make legacy software work like so many other problem-causing, Windows features. :)

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by WalterGR on Thursday July 02, 2015 @08:00PM (#9822535)

    I've love to know a scenario where OLE is actually used today.

Does it play no part in all of the [Clojure/Python/other langauge]-in-Excel posts that tend to get a decent number of upvotes here?

Maybe I'm mistaken about that - but it could have powered the kind of uber-notebook-in-Emacs packages that seem to be gaining popularity lately - twenty years ago.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by pjc50 on Friday July 03, 2015 @07:09AM (#9824768)

OLE the technology is rather fundamental to custom controls and a whole load of other things. You could probably remove all OLE embedding from Word documents and not break too many use cases, but in other applications it may be more important.

[ Parent | on HN ]