Free DISA STIG and SRG Library | Vaulted

Microsoft PowerPoint 2007

Version 4 Release 15
2016-04-22
U_MicrosoftPowerPoint2007_V4R15_Manual-xccdf.xml

Vulnerabilities (20)

Disable user name and password syntax from being used in URLs

Finding ID
DTOO104 - PowerPoint
Rule ID
SV-18179r3_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO104 - Disable user name and password
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://username:password@example.com. A malicious user might use this URL syntax to create a hyperlink that appears to open a legitimate website but actually opens a deceptive (spoofed) website. For example, the URL http://www.wingtiptoys.com@example.com appears to open http://www.wingtiptoys.com but actually opens http://example.com. To protect users from such attacks, Internet Explorer usually blocks any URLs using this syntax. This functionality can be controlled separately for instances of Internet Explorer spawned by 2007 Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a webpage). If user names and passwords in URLs are allowed, users could be diverted to dangerous webpages, which could pose a security risk.

Fix Text

Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Disable user name and password” to “Enabled” and select the "powerpnt.exe" and "pptview.exe" check boxes.

Check Content

Validate the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Disable user name and password” is set to “Enabled” and ‘powerpnt.exe’ and ‘pptview.exe’ are checked. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE Criteria: If the value powerpnt.exe is REG_DWORD = 1, this is not a finding. HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE Criteria: If the value pptview.exe is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Enable IE Bind to Object functionality for instances of IE launched from PowerPoint.

Finding ID
DTOO111 - PowerPoint
Rule ID
SV-18186r3_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO111 - Enable IE Bind to Object
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Internet Explorer performs a number of safety checks before initializing an ActiveX control. It will not initialize a control if the kill bit for the control is set in the registry, or if the security settings for the zone in which the control is located do not allow it to be initialized. This functionality can be controlled separately for instances of Internet Explorer spawned by 2007 Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). A security risk could occur if potentially dangerous controls are allowed to load.

Fix Text

Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Bind to Object” to “Enabled” and select the "powerpnt.exe" and "pptview.exe" check boxes.

Check Content

Validate the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Bind to Object” is set to “Enabled” and "powerpnt.exe" and "pptview.exe" check boxes are checked. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT Criteria: If the value powerpnt.exe is REG_DWORD = 1, this is not a finding. HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT Criteria: If the value pptview.exe is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Evaluate Saved from URL mark when launched from PowerPoint

Finding ID
DTOO117 - PowerPoint
Rule ID
SV-18201r3_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO117 - Saved from URL
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Typically, when Internet Explorer loads a Web page from a UNC share that contains a Mark of the Web (MOTW) comment that indicates the page was saved from a site on the Internet, Internet Explorer runs the page in the Internet security zone instead of the less restrictive Local Intranet security zone. This functionality can be controlled separately for instances of Internet Explorer spawned by 2007 Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). If Internet Explorer does not evaluate the page for a MOTW, potentially dangerous code could be allowed to run.

Fix Text

Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Saved from URL” to “Enabled” and select the "PowerPnt.exe" and "PPTView.exe" check boxes.

Check Content

Validate the policy value for Computer Configuration -> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Saved from URL” is set to “Enabled” and "powerpnt.exe" and "pptview.exe" check boxes are checked. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK Criteria: If the value powerpnt.exe is REG_DWORD = 1, this is not a finding. HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK Criteria: If the value pptview.exe is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Block navigation to URL embedded in Office products to protect against attack by malformed URL.

Finding ID
DTOO123 - PowerPoint
Rule ID
SV-18208r3_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO123-Block Navigation to URL from Office
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

To protect users from attacks, Internet Explorer usually does not attempt to load malformed URLs. This functionality can be controlled separately for instances of Internet Explorer spawned by 2007 Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). If Internet Explorer attempts to load a malformed URL, a security risk could occur in some cases.

Fix Text

Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Navigate URL” to “Enabled” and select the "powerpnt.exe" and "pptview.exe" check boxes.

Check Content

Validate the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Navigate URL” is set to “Enabled” and "powerpnt.exe" and "pptview.exe" check boxes are checked. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL Criteria: If the value powerpnt.exe is REG_DWORD = 1, this is not a finding. HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL Criteria: If the value pptview.exe is REG_DWORD = 1, this is not a finding. Fix Text: Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Navigate URL” to “Enabled” and select the "powerpnt.exe" and "pptview.exe" check boxes.

Responsibility

System Administrator

Block pop-ups for links that invoke instances of IE from within PowerPoint.

Finding ID
DTOO129 - PowerPoint
Rule ID
SV-18211r3_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO129 - Block Pop-Ups
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Pop-up Blocker feature in Internet Explorer can be used to block most unwanted pop-up and pop-under windows from appearing. This functionality can be controlled separately for instances of Internet Explorer spawned by 2007 Office applications (for example, if a user clicks a link in an Office document or selects a menu option that loads a Web page). If the Pop-up Blocker is disabled, disruptive and potentially dangerous pop-up windows could load and present a security risk.

Fix Text

Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Block popups” to “Enabled” and select the "powerpnt.exe" and "pptview.exe" check boxes.

Check Content

Validate the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2007 system (Machine) >> Security Settings >> IE Security “Block popups” is set to “Enabled” and "powerpnt.exe" and "pptview.exe" check boxes are checked. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT Criteria: If the value powerpnt.exe is REG_DWORD = 1, this is not a finding. HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT Criteria: If the value pptview.exe is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Disable Trust Bar Notification for unsigned application add-ins -PowerPoint

Finding ID
DTOO131 - PowerPoint
Rule ID
SV-18222r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO131 - Trust Bar Notifications
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

By default, if an application is configured to require that all add-ins be signed by a trusted publisher, any unsigned add-ins the application loads will be disabled and the application will display the Trust Bar at the top of the active window. The Trust Bar contains a message that informs users about the unsigned add-in.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center “Disable Trust Bar Notification for unsigned application add-ins” will be set to “Enabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center “Disable Trust Bar Notification for unsigned application add-ins” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security Criteria: If the value NoTBPromptUnsignedAddin is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Block opening of pre-release versions of file formats new to PowerPoint 2007 through the Compatibility Pack for the 2007 Office system and PowerPoint 2007 Converter - System

Finding ID
DTOO210 - Powerpoint
Rule ID
SV-18562r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO210 - Block opening of pre-release versions
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats enables users of Microsoft Word 2000, Word 2002, and Office Word 2003 to open files saved in the Office Open XML format used by Word 2007. Word Open XML files usually have the following extensions: • .docx • .docm • .dotx • .dotm • .xml By default, the Compatibility Pack does not open files that were saved in pre-release versions of the new Office Open XML format, which underwent some minor changes prior to the final release of Word 2007. If this configuration is changed, through a registry modification or by some other mechanism, users with the Compatibility Pack installed can open files saved by some pre-release versions of Word, but not by others, which can lead to inconsistent file opening functionality.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office 2007 system -> Office 2007 Converters “Block opening of pre-release versions of file formats new to PowerPoint 2007 through the Compatibility Pack for the 2007 Office system and PowerPoint 2007 Converter” will be set to “Enabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office 2007 system -> Office 2007 Converters “Block opening of pre-release versions of file formats new to PowerPoint 2007 through the Compatibility Pack for the 2007 Office system and PowerPoint 2007 Converter” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security\FileOpenBlock Criteria: If the value PowerPoint12BetaFilesFromConverters is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Disable all Trusted Locations.

Finding ID
DTOO133 - Powerpoint
Rule ID
SV-18530r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO133-Disable all trusted locations
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Trusted locations specified in the Trust Center are used to define file locations that are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with a minimal amount of security, without prompting the users for permission. If a dangerous file is opened from a trusted location, it will not be subject to standard security measures and could harm users' computers or data. By default, files located in trusted locations (those specified in the Trust Center) are assumed to be safe.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center -> Trusted Locations “Disable all trusted locations” will be set to “Enabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center -> Trusted Locations “Disable all trusted locations” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security\Trusted Locations Criteria: If the value AllLocationsDisabled is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Determine whether to force encrypted macros to be scanned in open XML presentations.

Finding ID
DTOO142 - Powerpoint
Rule ID
SV-18535r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO142 - Force Scan Encr. Macros in open XML
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

When an Office Open XML document (Word, Excel, Powerpoint) is rights-managed or password-protected, any macros that are embedded in the document are encrypted along with the rest of the contents. By default, these encrypted macros will be disabled unless they are scanned by antivirus software immediately before being loaded. If this default configuration is modified, Office 2007 products will not require encrypted macros to be scanned before loading. They will be handled as specified by the Office 2007 System macro security settings, which can cause macro viruses to load undetected and lead to data loss or reduced application functionality.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security “Determine whether to force encrypted macros to be scanned in Microsoft PowerPoint Open XML presentations” will be set to “Enabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security “Determine whether to force encrypted macros to be scanned in Microsoft PowerPoint Open XML presentations” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security Criteria: If the value PowerPointBypassEncryptedMacroScan is REG_DWORD = 1, this not a finding.

Responsibility

System Administrator

Disable feature that would block older version of office products from saving files to open XML formats.

Finding ID
DTOO155 - PowerPoint
Rule ID
SV-18575r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO155-Disable File Save Block for XML file types
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Office Open XML format file types introduced in the 2007 Microsoft Office release offer a number of benefits compared with the previous binary file types supported in Office 2003, including the potential to reduce the effects of malicious code. Files can be identified as unable to run code, and will therefore ignore any embedded code. Also, any files that do have embedded code are easier to identify. For users who run older versions of these applications, Microsoft offers the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats, which enables them to open and save Open XML files. The Compatibility Pack can be used with the following Microsoft Office programs: • Word 2000 with Service Pack 3, Excel 2000 with Service Pack 3, and PowerPoint 2000 with Service Pack 3 • Word 2002 with Service Pack 3, Excel 2002 with Service Pack 3, and PowerPoint 2002 with Service Pack 3 • Word 2003 with at least Service Pack 1, Excel 2003 with at least Service Pack 1, and PowerPoint 2003 with at least Service Pack 1 • Microsoft Office Word Viewer 2003 • Microsoft Office Excel Viewer 2003 • Microsoft Office PowerPoint Viewer 2003 If users cannot save files in Office Open XML format for some reason, they will be unable to take advantage of the security benefits of the new file types.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> Block file formats -> Save “Block saving of Open Xml file types” will be set to “Disabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> Block file formats -> Save “Block saving of Open Xml file types” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security\FileSaveBlock Criteria: If the value OpenXmlFiles is REG_DWORD = 0, this is not a finding.

Responsibility

System Administrator

Block opening of "open XML" format files created by pre-release versions of PowerPoint

Finding ID
DTOO153 - PowerPoint
Rule ID
SV-18590r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO153-Block Open of pre-release "open XML" files
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

By default, users can open files that were saved in pre-release versions of the new Office Open XML format, which underwent some minor changes prior to the final release of Office 2007. Open XML files usually have the following extensions: • .xlsb • .xlsx • .xlsm • .xltx • .xltm • .xlam If a vulnerability is discovered that affects these kinds of files, you can use this setting to protect your organization against attacks by temporarily preventing users from opening files in these formats until a security patch is available. By default, these file types are not blocked in Office 2007 products.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> Block file formats -> Open “Block opening of pre-release versions of file formats new to PowerPoint 2007” will be set to “Enabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> Block file formats -> Open “Block opening of pre-release versions of file formats new to PowerPoint 2007” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security\FileOpenBlock Criteria: If the value PowerPoint12BetaFiles is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Block Opening of "Open XML" file types to prevent them automatically executing code.

Finding ID
DTOO154 - PowerPoint
Rule ID
SV-18594r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO154 - Block Opening "Open XML" file types
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

The Office Open XML format file types introduced in the 2007 Microsoft Office release offer a number of benefits compared to the previous binary file types supported in Office 2003, including the potential to reduce the effects of malicious code. Files can be identified as unable to run code, and will therefore ignore any embedded code. Also, any files that do have embedded code are easier to identify. If a vulnerability is discovered that affects Office Open XML files, you can use this setting to protect your organization against attacks by temporarily preventing users from opening files in these formats until a security patch is available.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> Block file formats -> Open “Block opening of Open Xml files types” will be set to “Disabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> Block file formats -> Open “Block opening of Open Xml files types” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security\FileOpenBlock Criteria: If the value OpenXmlFiles is REG_DWORD = 0, this is not a finding.

Responsibility

System Administrator

Disable settings for content and add-ins that "Allow trusted locations not on computer" that might bypass more stringent security checks.

Finding ID
DTOO134 - PowerPoint
Rule ID
SV-18599r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO134 - Trusted locations on computer
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

By default, files located in trusted locations and specified in the Trust Center are assumed to be safe. Content, code, and add-ins are allowed to load from trusted locations with minimal security and without prompting the user for permission. By default, users can specify trusted locations on network shares or in other remote locations that are not under their direct control by selecting the Allow Trusted Locations on my network (not recommended) check box in the Trusted Locations section of the Trust Center. If a dangerous file is opened from a trusted location, it will not be subject to typical security measures and could affect users' computers or data.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center -> Trusted Locations “Allow Trusted Locations not on the computer” will be set to “Disabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center -> Trusted Locations “Allow Trusted Locations not on the computer” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security\Trusted Locations Criteria: If the value AllowNetworkLocations is REG_DWORD = 0, this is not a finding.

Responsibility

System Administrator

Save files default format as backward compatible, not as XML.

Finding ID
DTOO139 - PowerPoint
Rule ID
SV-18607r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO139 - Save files default format
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

By default, Office 2007 producst save new workbooks in the Office Open XML format. For users who run prior versions of Office products, Microsoft offers the Microsoft Office Compatibility Pack, which enables these versions to open and save open XML format. If some users in your organization cannot install the Compatibility Pack, or are running other versions of Office products these users might not be able to access Excel files saved in the Open XML format.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Save “save files in this format” will be set to “Enabled (PowerPoint 97-2003 Presentation (*.ppt) or Enabled (PowerPoint Presentation (*.pptx)”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Save “save files in this format” will be set to “Enabled (PowerPoint 97-2003 Presentation (*.ppt) or Enabled (PowerPoint Presentation (*.pptx)”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Options Criteria: If the value DefaultFormat is REG_DWORD = 0 for Powerpoint 97 - 2003 or DefaultFormat is REG_DWORD = 1b (hex) 27 (dec) for Powerpoint 2007 , this is not a finding.

Responsibility

System Administrator

Disable Trust access for VBA into Excel, Word, and PowerPoint.

Finding ID
DTOO146 - PowerPoint
Rule ID
SV-18611r4_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO146-Disable Trust access to VB Project Macros
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

VSTO projects require access to the Visual Basic for Applications project system in Excel 2007, PowerPoint 2007, and Word 2007, even though the projects do not use Visual Basic for Applications. Design-time support of controls in both Visual Basic and C# projects depends on the Visual Basic for Applications project system in Word and Excel. By default, Excel, Word, and PowerPoint do not allow automation clients to have programmatic access to VBA projects. Users can enable this by selecting the Trust access to the VBA project object model in the Macro Settings section of the Trust Center. However, doing so allows macros in any documents the user opens to access the core Visual Basic objects, methods, and properties, which represents a potential security hazard.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center “Trust access to Visual Basic Project” will be set to “Disabled”.

Check Content

Validate the policy value for User Configuration >> Administrative Templates >> Microsoft Office PowerPoint 2007 >> PowerPoint Options >> Security >> Trust Center “Trust access to Visual Basic Project” is set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security\ If the value for AccessVBOM is REG_DWORD=0, this is not a finding.

Responsibility

System Administrator

Enable Warning Bar settings for VBA macros contained in PowerPoint Files.

Finding ID
DTOO304 - PowerPoint
Rule ID
SV-18639r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO304 - VBA Macro Warning settings
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

By default, when users open files in the specified applications that contain VBA macros, the applications open the files with the macros disabled and display the Trust Bar with a warning that macros are present and have been disabled. Users can inspect and edit the files if appropriate, but cannot use any disabled functionality until they enable it by clicking Options on the Trust Bar and selecting the appropriate action. If users enable dangerous macros, it could affect their computers or cause sensitive information to be compromised.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center “VBA Macro Warning Settings” will be set to “Enabled (Trust Bar warning for all macros)”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security -> Trust Center “VBA Macro Warning Settings” will be set to “Enabled (Trust Bar warning for all macros)”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security Criteria: If the value VBAWarnings is REG_DWORD = 2, this is not a finding.

Responsibility

System Administrator

Block PowerPoint from automatically opening converters to view older PowerPoint presentations.

Finding ID
DTOO299 - PowerPoint
Rule ID
SV-18665r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO299 - Block Converters Opening
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

PowerPoint 2007 requires the use of a conversion tool to open presentations saved in versions of PowerPoint older than PowerPoint 97, such as PowerPoint 95, PowerPoint 4.0, and others. If a vulnerability is discovered that affects these kinds of files, you can use this setting to protect your organization against attacks by temporarily preventing users from opening files in these formats until a security patch is available.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> Block file formats -> Open “Block opening of Converters” will be set to “Enabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> Block file formats -> Open “Block opening of Converters” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security\FileOpenBlock Criteria: If the value Converters is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Make hidden markup invisible - PowerPoint

Finding ID
DTOO290 - PowerPoint
Rule ID
SV-18943r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO290 - Make Hidden marks visible in PowerPoint
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

PowerPoint presentations that are saved in standard or HTML format can contain a flag indicating whether markup (comments or ink annotations) in the presentation should be visible when the presentation is open. By default, PowerPoint 2007 ignores this flag when opening a file, and always displays any markup present in the file. In addition, when saving a file, PowerPoint sets the flag to display markup when the presentation is next opened. If this default configuration is changed, PowerPoint sets the flag according to the state of the Show Markup option on the Review tab of the Ribbon when it saves presentations in standard or HTML format. In addition, PowerPoint enables or disables the Show Markup option according to the way the flag is set when it opens files, which means that a presentation saved with hidden markup is opened with the markup still hidden. If a file is saved with hidden markup, users might inadvertently distribute sensitive comments or information to others via the presentation file.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security “Make hidden markup visible” will be set to “Enabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security “Make hidden markup visible” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Options Criteria: If the value MarkupOpenSave is REG_DWORD = 1, this is not a finding.

Responsibility

System Administrator

Disable the ability to run programs from a PowerPoint presentation.

Finding ID
DTOO289 - PowerPoint
Rule ID
SV-19007r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO289 - Running programs in PowerPoint
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Action buttons can be used to launch external programs from PowerPoint 2007 presentations. If a malicious person adds an action button to a presentation that launches a dangerous program, it could significantly affect the security of a user's computer and data.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security “Run Programs” will be set to “Enabled (disable (don't run any programs))”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security “Run Programs” will be set to “Enabled (disable (don't run any programs))”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security Criteria: If the value RunPrograms is REG_DWORD = 0, this is not a finding

Responsibility

System Administrator

Disable the feature to "unblock automatic download of linked images" in PowerPoint.

Finding ID
DTOO291 - PowerPoint
Rule ID
SV-19044r1_rule
Severity
Cat II
CCE
(None)
Group Title
DTOO291 - Linked images
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

When users insert images into PowerPoint 2007 presentations, they can select Link to File instead of Insert. If they do so, the image is represented by a link to a file on disk instead of being embedded in the presentation file itself. By default, when PowerPoint opens a presentation it does not display any linked images saved on a different computer unless the presentation itself is saved in a trusted location (as configured in the Trust Center). If this configuration is changed, PowerPoint will load any images that were saved in remote locations, which presents a security risk.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security “Unblock automatic download of linked images” will be set to “Disabled”.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office PowerPoint 2007 -> PowerPoint Options -> Security “Unblock automatic download of linked images” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\PowerPoint\Security Criteria: If the value DownloadImages is REG_DWORD = 0, this is not a finding

Responsibility

System Administrator