Always show Document Information Panel Beaconing UI

Always show Document Information Panel Beaconing UI - Office

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17605	DTOO207 - Office 2007	SV-18740r1_rule	ECSC-1	Medium

Description
InfoPath 2007 can be used to create custom Document Information Panels that can be attached to Excel 2007 workbooks, PowerPoint 2007 presentations, and Word 2007 documents. A malicious user could insert a Web beacon into an InfoPath form that is used to create a custom Document Information Panel. Web beacons can be used to contact an external server when users open the form. Information could be gathered by the form, or information entered by users could be sent to an external server and cause them to be vulnerable to additional attacks.

Description

InfoPath 2007 can be used to create custom Document Information Panels that can be attached to Excel 2007 workbooks, PowerPoint 2007 presentations, and Word 2007 documents. A malicious user could insert a Web beacon into an InfoPath form that is used to create a custom Document Information Panel. Web beacons can be used to contact an external server when users open the form. Information could be gathered by the form, or information entered by users could be sent to an external server and cause them to be vulnerable to additional attacks.

STIG	Date
Microsoft Office System 2007	2014-01-07

Details

Check Text ( C-18907r1_chk )
The policy value for User Configuration -> Administrative Templates -> Microsoft Office 2007 system -> Document Information Panel “Document Information Panel Beaconing UI” will be set to “Enabled (Always show UI)”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Common\DocumentInformationPanel Criteria: If the value Beaconing is REG_DWORD = 1, this is not a finding.

Check Text ( C-18907r1_chk )

The policy value for User Configuration -> Administrative Templates -> Microsoft Office 2007 system -> Document Information Panel “Document Information Panel Beaconing UI” will be set to “Enabled (Always show UI)”.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\12.0\Common\DocumentInformationPanel

Criteria: If the value Beaconing is REG_DWORD = 1, this is not a finding.

Fix Text (F-17523r1_fix)
The policy value for User Configuration -> Administrative Templates -> Microsoft Office 2007 system -> Document Information Panel “Document Information Panel Beaconing UI” will be set to “Enabled (Always show UI)”. "Note: Group Policy Administrative Templates are available from the www.microsoft.com download site. The MS Office 2007 System (Office12.adm) is included in the AdminTemplates.exe file. This template provides the mechanisms to incorporate Microsoft Office 2007 System policies via the Microsoft Group Policy Editor (gpedit.msc)." "Note: If the Microsoft Group Policy Editor (gpedit.msc) is not used to incorporate the remediation to this vulnerability the Microsoft Registry Editor (regedit.exe) may be used to create the registry key and value required."

Fix Text (F-17523r1_fix)

The policy value for User Configuration -> Administrative Templates -> Microsoft Office 2007 system -> Document Information Panel “Document Information Panel Beaconing UI” will be set to “Enabled (Always show UI)”.

"Note: Group Policy Administrative Templates are available from the www.microsoft.com download site. The MS Office 2007 System (Office12.adm) is included in the AdminTemplates.exe file. This template provides the
mechanisms to incorporate Microsoft Office 2007 System policies via the Microsoft Group Policy Editor (gpedit.msc)."

"Note: If the Microsoft Group Policy Editor (gpedit.msc) is not used to incorporate the remediation to this vulnerability the Microsoft Registry Editor (regedit.exe) may be used to create the registry key and value required."