Dear Mr. Poehls,

I think Microsoft does not consider metadata attached to a document as =
part of the document and so they decided not to include it in the =
content protected by the certificate.=20

This fits the way we use attaching metadata during the process of =
categorization to enable retrieval of a document by means and taxonomies =
of the recipient, not of the author. If instead, as you seem to propose, =
metadata would be treated as part of the document, attaching the =
metadata needed for retrieval purposes would invalidate the signature of =
the document.=20

Therefore this time I would go with Microsoft for their solution fits =
our needs and doesn't compromise the integrity protection of the =
document itself in any serious way. Just think of it as a sticker placed =
on the outside of a sealed envelope: You mustn't trust anything on the =
outside, just look inside the envelope to find the information you can =
rely on.

Yours
H.-D. Naujoks
T=DCV S=DCD Informatik und Consulting Services GmbH

-----Urspr=FCngliche Nachricht-----
Von: poehls@informatik.uni-hamburg.de =
[mailtooehls@informatik.uni-hamburg.de]=20
Gesendet: Mittwoch, 12. Dezember 2007 11:35
An: bugtraq@securityfocus.com
Betreff: MS Office 2007: Digital Signature does not protect Meta-Data


Affects: Microsoft Office 2007 (12.0.6015.5000)=20

MSO (12.0.6017.5000)=20

possibly older versions



I. Background


Microsoft Office is a suite containing several programs to

handle Office documents like text documents or spreadsheets.=20

The latest version uses an XML based document format.=20

Microsoft Office allows documents to be digitally signed by

authors using certified keys, allowing viewers to verify the=20

integrity and the origin based on the author's public key.=20

The author's public key certificate, which can come from a=20

trusted third party, is embedded in the signed document.=20

It is XML DSig based.



II. Problem Description


Microsoft Office documents carry meta data information=20

according to the DublinCore metadata in the file=20

docProps/core.xml . Among these meta data information=20

are the fields "LastModifiedBy", "creator" together with=20

several others that can be displayed/changed through the=20

following menu "Office Button -> Prepare -> Properties".

These entries can be changed without invalidating the signature.=20

At least under Windows Operating Systems these information are=20

also shown in the Window's file systems properties.



III. Impact


The meta data of signed Microsoft Office documents can be=20

changed. An attacker can change the values to spoof the origin=20

of signed documents, hoping to induce trust or otherwise=20

deceive the user.


III.1. Proof of Concept


Open the OOXML ZIP container of a signed document.=20

Change the values in the docProps/core.xml file.=20

For example set the value between "<dc:creator>*</dc:creator>"=20

to "<dc:creator>FooBar</dc:creator>".=20

The changes will be displayed in the document's properties=20

dialog as described above. The signature will still be valid.



IV. Workaround


The meta data information of a signed OOXML document=20

can be changed without invalidating the signature, thus=20

information about the real author of a signed document can

only be retrieved from the certificate.=20

The signed file's meta data can not be trusted as the=20

meta data is not covered by the signature.

=20


V. Solution


No possible solution.



VI. Correction details


A closer look into the references section of the XML signature=20

used by Microsoft Office (stored in the File=20

_xmlsignatures\sig1.xml) reveals that the file core.xml is=20

not in the list of references. Thus it is not covered by the

signature.=20


As a solution the scope of the signature needs to be extended=20

to cover all the relevant information contained in the whole=20

document, thus also the meta data in core.xml.


Include core.xml, and probably other files in the signature's=20

list of references.


VII. Time line


2007-10-24: Vendor contacted

2007-10-25: Vendor acknowledged receipt

2007-11-14: 1st Deadline reached

2007-11-27: Reminder sent

2007-12-12: No response received until today





Yours,

Henrich C. Poehls, Dong Tran, Finn Petersen, Frederic Pscheid

SVS - Dept. of Informatics - University of Hamburg