UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Dragging Unicode email messages to file system must be disallowed.


Overview

Finding ID Version Rule ID IA Controls Severity
V-17812 DTOO231 SV-53897r1_rule ECSC-1 Medium
Description
When users drag email messages from Outlook to a Windows Explorer window or to their Desktop, Outlook creates an .msg file using the native character encoding format for the configured locale (the so-called "ANSI" format). If this setting is Enabled, Outlook uses the Unicode character encoding standard to create the message file, which preserves special characters in the message. However, Unicode text is vulnerable to homograph attacks, in which characters are replaced by different but similar-looking characters. For example, the Cyrillic letter "?" (U+0430) appears identical to the Latin letter "a" (U+0061) in many typefaces, but is actually a different character. Homographs can be used in "phishing" attacks to convince victims to visit fraudulent websites and enter sensitive information.
STIG Date
Microsoft Outlook 2013 STIG 2014-01-06

Details

Check Text ( C-47922r1_chk )
Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Outlook Options -> Other -> Advanced "Use Unicode format when dragging e-mail message to file system" is set to "Disabled".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\15.0\outlook\options\general

Criteria: If the value MSGFormat is REG_DWORD = 0, this is not a finding.
Fix Text (F-46802r1_fix)
Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2013 -> Outlook Options -> Other -> Advanced "Use Unicode format when dragging e-mail message to file system" to "Disabled".