The Last Office For Mac

Posted on

Feels like a Mac app Microsoft moved fast to support Apple’s new operating systems this year, including the recent addition of support for use of Outlook (or Edge) as the default email client. Word includes a non-deleteable end-paragraph that sometimes gets pushed out to a new, blank page at the end of a document. The way to delete the page is to. The last offices, or laying out, is the procedures performed, usually by a nurse, to the body of a dead person shortly after death has been confirmed. They can vary between hospitals and between cultures Name. The word 'offices' is related to the original Latin, in which officium means 'service.

Overview

The Microsoft Office for Mac option 'Disable all macros without notification' enables XLM macros without prompting, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.

Description

XLM macros

Up to and including Microsoft Excel 4.0, a macro format called XLM was available. XLM macros predate the VBA macros that are more common with modern Microsoft Office systems, however current Microsoft Office versions still support XLM macros.
SYLK and XLM macros
XLM macros can be incorporated into SYLK files, as outlined by Outflank. Macros in the SYLK format are problematic in that Microsoft Office does not open in Protected View to help protect users. This means that users may be a single click away from arbitrary code execution via a document that originated from the internet.
SYLK and XLM macros with Microsoft Office for Mac
It has been reported that Office 2011 for Mac fails to warn users before opening SYLK files that contain XLM macros. According to this post, Microsoft has reported that Office 2016 and Office 2019 for Mac properly prompt the user before executing XLM macros in SYLK files.
The Problem
If Office for the Mac has been configured to use the 'Disable all macros without notification' feature, XLM macros in SYLK files are executed without prompting the user.

Impact

By convincing a user to open specially-crafted Microsoft Excel content on a Mac that has 'Disable all macros without notification' enabled, a remote, unauthenticated attacker may be able to execute arbitrary code with privileges of the user running Excel.

Solution

Apply an update
This issue is addressed for Office 2016 for Mac build 16.16.16 (19111100) and Office 2019 for Mac build 16.31 (19111002), as described in the Microsoft Security update for CVE-2019-1457.

Block SYLK files at email and web gateways
SYLK files, which have the file extension SLK, should be blocked at email and web gateways to help prevent exploitation of this vulnerability.

Office history for macOffice

Vendor Information

Javascript is disabled. Click here to view vendors.

Microsoft Affected

Notified: October 31, 2019 Updated: November 12, 2019

Status

Affected

Vendor Statement

The Last Office For Macbook Pro

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References


Microsoft Office For The Mac

CVSS Metrics

GroupScoreVector
Base 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
Temporal 5.8 E:POC/RL:W/RC:C
Environmental 4.4 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Acknowledgements

This issue was reported by Will Dormann of the CERT/CC.

This document was written by Will Dormann.

The Last Office For Macbook

Other Information

The Last Office For Macbook Air

CVE IDs:CVE-2019-1457
Date Public:2019-10-31
Date First Published:2019-11-01
Date Last Updated: 2019-11-15 12:51 UTC
Document Revision: 38