"Clippy" the Office 2000 assistant has a security hole!

Question

"Clippy" the Office 2000 assistant has a security hole!

Answer

This question was answered on May 17, 2000. Much of the information contained herein may have changed since posting.

We have all come to know and love/hate the animated office assistants in Microsoft's Office suite. Unfortunantly, a potential security hole has been found in the Office 2000 version of "Clippy". The hole, which allows an attacker to write a script that can do anything once on a user's computer, gets activated by clicking on a Web page or HTML-enabled e-mail. The script can then add or delete files.

"Because its abilities are marked 'safe for scripting,' anything is possible," said the security researcher that found the hole, a hacker known as "Dildog" who works for the security firm @Stake Inc.

Microsoft has released a patch for this hole that is specific to Office 2000 and its family of products that include:

Word 2000

Excel 2000

Powerpoint 2000

Access 2000

Photodraw 2000

FrontPage 2000

Project 2000

Publisher 2000

Outlook 2000

Works 2000 Suite

The patch and more information can be downloaded at:

<a href="http://www.microsoft.com/technet/security/bulletin/ms00-034.asp"><font color="#003399">http://www.microsoft.com/technet/security/bulletin/ms00-034.asp</font></a>

Author

Posted by Ken of Data Doctors on May 17, 2000