full-disclosure - Gnumeric and Applix can modify locked Excel files?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200405210316.i4L3Gex29743@milan.maths.usyd.edu.au>
From: psz at maths.usyd.edu.au (Paul Szabo)
Subject: Gnumeric and Applix can modify locked Excel files?

Dave Horsfall <dave@...sfall.org> wrote:

> I found I was able to modify a supposedly password-locked Excel file
> without the password, with Gnumeric (a free *nix clone of Excel) and
> Applix (a commercial *nix clone of Office).

Similar issues have been discussed previously, in the context of Word.
Quoting from my

  http://www.maths.usyd.edu.au:8000/u/psz/securepc.html#MSOffice

page:

  Microsoft Word Protection Bypass
  http://www.securityfocus.com/archive/1/348692
  http://www.securityfocus.com/archive/1/349157 
  Though
  http://www.microsoft.com/technet/prodtechnol/office/office2000/reskit/ork2000/html/65t2_2.asp
  says that Password to Modify uses encryption,
  http://support.microsoft.com/?kbid=822924
  admits that it also may be bypassed; and
  http://www.microsoft.com/technet/columns/security/askus/auas0301.asp
  knew that already in 2001...

Is the Excel issue related?

Cheers,

Paul Szabo - psz@...hs.usyd.edu.au  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia