Create configuration to prevent Internet links and Network UNCs from being created as embedded hyperlinks.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17650	DTOO138 - Excel	SV-18797r3_rule	ECSC-1	Medium

Description
By default, when users type a string of characters that Excel 2007 recognizes as a Uniform Resource Locator (URL) or Uniform Naming Convention (UNC) path to a resource on the Internet or a local network, Excel will transform it into a hyperlink. Clicking the hyperlink opens it in the configured default Web browser or the appropriate application. This functionality can enable users to accidentally create links to dangerous or restricted resources, which could create a security risk.

Description

By default, when users type a string of characters that Excel 2007 recognizes as a Uniform Resource Locator (URL) or Uniform Naming Convention (UNC) path to a resource on the Internet or a local network, Excel will transform it into a hyperlink. Clicking the hyperlink opens it in the configured default Web browser or the appropriate application. This functionality can enable users to accidentally create links to dangerous or restricted resources, which could create a security risk.

STIG	Date
Microsoft Excel 2007	2014-01-07

Details

Check Text ( C-18922r6_chk )
If Office 2007 PRE SP2: The policy value for User Configuration -> Administrative Templates -> Microsoft Office Excel 2007 -> Excel Options -> Proofing -> Autocorrect Options “Internet and network paths as hyperlinks” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Excel\Options Criteria: If the value AutoHyperlink exists, this is a finding. If Office 2007 SP2 : The policy value for User Configuration -> Administrative Templates -> Microsoft Office Excel 2007 -> Excel Options -> Proofing -> Autocorrect Options “Internet and network paths as hyperlinks” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Excel\Options Criteria: If the value AutoHyperlink is REG_DWORD=0, this is not a finding.

Check Text ( C-18922r6_chk )

If Office 2007 PRE SP2: The policy value for User Configuration -> Administrative Templates -> Microsoft Office Excel 2007 -> Excel Options -> Proofing -> Autocorrect Options “Internet and network paths as hyperlinks” will be set to “Disabled”.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\12.0\Excel\Options

Criteria: If the value AutoHyperlink exists, this is a finding.

If Office 2007 SP2 :
The policy value for User Configuration -> Administrative Templates -> Microsoft Office Excel 2007 -> Excel Options -> Proofing -> Autocorrect Options “Internet and network paths as hyperlinks” will be set to “Disabled”.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\12.0\Excel\Options

Criteria: If the value AutoHyperlink is REG_DWORD=0, this is not a finding.

Fix Text (F-17549r3_fix)
The policy value for User Configuration -> Administrative Templates -> Microsoft Office Excel 2007 -> Excel Options -> Proofing -> Autocorrect Options “Internet and network paths as hyperlinks” will be set to “Disabled”.