The Misuse of RC4 in Microsoft Word and Excel

From: Hongjun Wu (hongjun_at_i2r.a-star.edu.sg)
Date: 01/11/05

  • Next message: Lee Howard: "HylaFAX hfaxd unauthorized login vulnerability" 
    Date: 11 Jan 2005 11:37:54 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    There is a serious security flaw in Microsoft Word and Excel. (To the best of my knowledge, this flaw has not been reported in public before.)

    The stream cipher RC4 with key length up to 128 bits is used in Microsoft Word and Excel to encrypt the documents. But when an encrypted document gets modified and saved, the initialization vector of RC4 remains the same. Thus the same keystream generated from RC4 is applied to encrypt the different versions of that document. The consequence is disastrous since a lot of information of that document could be recovered easily from those encrypted different versions.

    The details of the flaw are described in the document (PDF):

        http://eprint.iacr.org/2005/007.pdf

  • Next message: Lee Howard: "HylaFAX hfaxd unauthorized login vulnerability"

    Relevant Pages

    • Alert: Microsoft Security Bulletin - MS02-059
      ... Flaw in Word Fields and Excel External Updates Could Lead to Information Disclosure ... Customers using Microsoft® Word or Microsoft® Excel. ... Microsoft Word 2002 ... In order for an attacker to take advantage of this vulnerability, the attacker would need to perform the following steps: ...
      (NT-Bugtraq)
    • Re: Printing prn files
      ... A mistake in my first post where I intended to say "Microsoft Word and Microsoft Excel". ... >> I have no idea how setting a print area in Excel could relate to the ...
      (microsoft.public.windowsxp.print_fax)
    • Re: Excel opens files very slowly
      ... slightly different wording which gave me completely different results. ... I've now also discovered that Microsoft Word has problems on the problem PC. ... launching, where in Excel, Excel ... James ...
      (microsoft.public.excel)
    • Re: Special Characters (Unicode, Ascii) in Python and MySQL
      ... Special characters and punctuation all seem not to be stored and ... perhaps the encoding of the database itself should be different? ... 'ascii' codec can't decode byte 0xe2 in position ... and pasted from Microsoft Word. ...
      (comp.lang.python)
    • Re: Locked keyboard
      ... Have you activated your copy of Word and Excel? ... If there is a command there about "Activate" try it. ... > my keyboard does not work with Microsoft Word and Excel. ... > esential to Word or that one of the intruding files ...
      (microsoft.public.word.application.errors)
    Loading