Naujoks, Hans-Dietmar
13/12/07, 18:35
Dear Mr. Poehls,
I think Microsoft does not consider metadata attached to a document as =
part of the document and so they decided not to include it in the =
content protected by the certificate.=20
This fits the way we use attaching metadata during the process of =
categorization to enable retrieval of a document by means and taxonomies =
of the recipient, not of the author. If instead, as you seem to propose, =
metadata would be treated as part of the document, attaching the =
metadata needed for retrieval purposes would invalidate the signature of =
the document.=20
Therefore this time I would go with Microsoft for their solution fits =
our needs and doesn't compromise the integrity protection of the =
document itself in any serious way. Just think of it as a sticker placed =
on the outside of a sealed envelope: You mustn't trust anything on the =
outside, just look inside the envelope to find the information you can =
rely on.
Yours
H.-D. Naujoks
T=DCV S=DCD Informatik und Consulting Services GmbH
-----Urspr=FCngliche Nachricht-----
Von: poehls@informatik.uni-hamburg.de =
[mailto:poehls@informatik.uni-hamburg.de]=20
Gesendet: Mittwoch, 12. Dezember 2007 11:35
An: bugtraq@securityfocus.com
Betreff: MS Office 2007: Digital Signature does not protect Meta-Data
Affects: Microsoft Office 2007 (12.0.6015.5000)=20
MSO (12.0.6017.5000)=20
possibly older versions
I. Background
Microsoft Office is a suite containing several programs to
handle Office documents like text documents or spreadsheets.=20
The latest version uses an XML based document format.=20
Microsoft Office allows documents to be digitally signed by
authors using certified keys, allowing viewers to verify the=20
integrity and the origin based on the author's public key.=20
The author's public key certificate, which can come from a=20
trusted third party, is embedded in the signed document.=20
It is XML DSig based.
II. Problem Description
Microsoft Office documents carry meta data information=20
according to the DublinCore metadata in the file=20
docProps/core.xml . Among these meta data information=20
are the fields "LastModifiedBy", "creator" together with=20
several others that can be displayed/changed through the=20
following menu "Office Button -> Prepare -> Properties".
These entries can be changed without invalidating the signature.=20
At least under Windows Operating Systems these information are=20
also shown in the Window's file systems properties.
III. Impact
The meta data of signed Microsoft Office documents can be=20
changed. An attacker can change the values to spoof the origin=20
of signed documents, hoping to induce trust or otherwise=20
deceive the user.
III.1. Proof of Concept
Open the OOXML ZIP container of a signed document.=20
Change the values in the docProps/core.xml file.=20
For example set the value between "<dc:creator>*</dc:creator>"=20
to "<dc:creator>FooBar</dc:creator>".=20
The changes will be displayed in the document's properties=20
dialog as described above. The signature will still be valid.
IV. Workaround
The meta data information of a signed OOXML document=20
can be changed without invalidating the signature, thus=20
information about the real author of a signed document can
only be retrieved from the certificate.=20
The signed file's meta data can not be trusted as the=20
meta data is not covered by the signature.
=20
V. Solution
No possible solution.
VI. Correction details
A closer look into the references section of the XML signature=20
used by Microsoft Office (stored in the File=20
_xmlsignatures\sig1.xml) reveals that the file core.xml is=20
not in the list of references. Thus it is not covered by the
signature.=20
As a solution the scope of the signature needs to be extended=20
to cover all the relevant information contained in the whole=20
document, thus also the meta data in core.xml.
Include core.xml, and probably other files in the signature's=20
list of references.
VII. Time line
2007-10-24: Vendor contacted
2007-10-25: Vendor acknowledged receipt
2007-11-14: 1st Deadline reached
2007-11-27: Reminder sent
2007-12-12: No response received until today
Yours,
Henrich C. Poehls, Dong Tran, Finn Petersen, Frederic Pscheid
SVS - Dept. of Informatics - University of Hamburg
I think Microsoft does not consider metadata attached to a document as =
part of the document and so they decided not to include it in the =
content protected by the certificate.=20
This fits the way we use attaching metadata during the process of =
categorization to enable retrieval of a document by means and taxonomies =
of the recipient, not of the author. If instead, as you seem to propose, =
metadata would be treated as part of the document, attaching the =
metadata needed for retrieval purposes would invalidate the signature of =
the document.=20
Therefore this time I would go with Microsoft for their solution fits =
our needs and doesn't compromise the integrity protection of the =
document itself in any serious way. Just think of it as a sticker placed =
on the outside of a sealed envelope: You mustn't trust anything on the =
outside, just look inside the envelope to find the information you can =
rely on.
Yours
H.-D. Naujoks
T=DCV S=DCD Informatik und Consulting Services GmbH
-----Urspr=FCngliche Nachricht-----
Von: poehls@informatik.uni-hamburg.de =
[mailto:poehls@informatik.uni-hamburg.de]=20
Gesendet: Mittwoch, 12. Dezember 2007 11:35
An: bugtraq@securityfocus.com
Betreff: MS Office 2007: Digital Signature does not protect Meta-Data
Affects: Microsoft Office 2007 (12.0.6015.5000)=20
MSO (12.0.6017.5000)=20
possibly older versions
I. Background
Microsoft Office is a suite containing several programs to
handle Office documents like text documents or spreadsheets.=20
The latest version uses an XML based document format.=20
Microsoft Office allows documents to be digitally signed by
authors using certified keys, allowing viewers to verify the=20
integrity and the origin based on the author's public key.=20
The author's public key certificate, which can come from a=20
trusted third party, is embedded in the signed document.=20
It is XML DSig based.
II. Problem Description
Microsoft Office documents carry meta data information=20
according to the DublinCore metadata in the file=20
docProps/core.xml . Among these meta data information=20
are the fields "LastModifiedBy", "creator" together with=20
several others that can be displayed/changed through the=20
following menu "Office Button -> Prepare -> Properties".
These entries can be changed without invalidating the signature.=20
At least under Windows Operating Systems these information are=20
also shown in the Window's file systems properties.
III. Impact
The meta data of signed Microsoft Office documents can be=20
changed. An attacker can change the values to spoof the origin=20
of signed documents, hoping to induce trust or otherwise=20
deceive the user.
III.1. Proof of Concept
Open the OOXML ZIP container of a signed document.=20
Change the values in the docProps/core.xml file.=20
For example set the value between "<dc:creator>*</dc:creator>"=20
to "<dc:creator>FooBar</dc:creator>".=20
The changes will be displayed in the document's properties=20
dialog as described above. The signature will still be valid.
IV. Workaround
The meta data information of a signed OOXML document=20
can be changed without invalidating the signature, thus=20
information about the real author of a signed document can
only be retrieved from the certificate.=20
The signed file's meta data can not be trusted as the=20
meta data is not covered by the signature.
=20
V. Solution
No possible solution.
VI. Correction details
A closer look into the references section of the XML signature=20
used by Microsoft Office (stored in the File=20
_xmlsignatures\sig1.xml) reveals that the file core.xml is=20
not in the list of references. Thus it is not covered by the
signature.=20
As a solution the scope of the signature needs to be extended=20
to cover all the relevant information contained in the whole=20
document, thus also the meta data in core.xml.
Include core.xml, and probably other files in the signature's=20
list of references.
VII. Time line
2007-10-24: Vendor contacted
2007-10-25: Vendor acknowledged receipt
2007-11-14: 1st Deadline reached
2007-11-27: Reminder sent
2007-12-12: No response received until today
Yours,
Henrich C. Poehls, Dong Tran, Finn Petersen, Frederic Pscheid
SVS - Dept. of Informatics - University of Hamburg