UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Custom Outlook Object Model (OOM) action execution prompts must be configured.


Overview

Finding ID Version Rule ID IA Controls Severity
V-17802 DTOO247 SV-53994r1_rule ECSC-1 Medium
Description
Custom actions add functionality to Outlook that can be triggered as part of a rule. Among other possible features, custom actions can be created that reply to messages in ways that circumvent the Outlook model's programmatic send protections. By default, when Outlook or another program initiates a custom action using the Outlook object model, users are prompted to allow or reject the action. If this configuration is changed, malicious code can use the Outlook object model to compromise sensitive information or otherwise cause data and computing resources to be at risk.
STIG Date
Microsoft Outlook 2013 STIG 2014-01-06

Details

Check Text ( C-47965r1_chk )
Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Security -> Security Form Settings -> Custom Form Security "Set Outlook object model Custom Actions execution prompt" is "Enabled (Automatically Deny)".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\15.0\outlook\security

Criteria: If the value PromptOOMCustomAction is REG_DWORD = 0, this is not a finding.
Fix Text (F-46883r1_fix)
Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Security -> Security Form Settings -> Custom Form Security "Set Outlook object model Custom Actions execution prompt" to "Enabled (Automatically Deny)".