This article describes the Microsoft Office legacy/binary file formats (doc, xls, ppt), related security issues and useful resources. [WORK IN PROGRESS]

The original location of this page is http://www.decalage.info/file_formats_security/office.

File format description

MS Office binary formats are widely used:

• Word documents (.doc) for texts.
• Excel workbook (.xls) for worksheets with numeric values.
• PowerPoint (.ppt) for presentations.

Except for very old MS Office versions, all these formats share the same basic container structure, either called OLE2, structured storage or compound document.

MS Office also contain other applications such as MS Access which use different file formats not based on the OLE2 format.

Since MS Office 2007, new file formats based on XML (docx, xslx, pptx) are used by default. These formats will be covered in a future article.

Main client applications

The main applications used to open MS Office files are part of the MS Office suite:

• MS Word for documents
• MS Excel for workbooks
• MS Powerpoint for presentations

Many alternative applications are also able to open MS Office files, such as OpenOffice, StarOffice, GNOME Office and KOffice.

Main security issues

• VBA macros
• OLE objects (particularly Package objects)

Format specifications and technical information

• Official Microsoft specifications: http://msdn.microsoft.com/en-us/library/cc313118.aspx
• Older version: http://www.microsoft.com/interop/docs/officebinaryformats.mspx
•  

Publications about MS Office formats security issues

• Malware and File formats, P. Lagadec, 2003: SSTIC03
•  

Examples of known vulnerabilities and exploits

Useful analysis tools

• SSView: http://www.mitec.cz/ssv.html, a visual MS OLE2 file parser and editor.
• OfficeCat: http://www.snort.org/vrt/vrt-resources/officecat, to detect many known exploits.
• OfficeMalScanner: http://www.reconstructer.org/code.html, to analyze suspicious MS Office documents and to extract VBA macros.
• OffVis: http://go.microsoft.com/fwlink/?LinkId=158791, a Microsoft tool to analyze suspicious MS Office documents. See also http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=...

Parsing tools and libraries

• OleFileIO_PL: a Python module to parse and read MS OLE2 files.
• xlrd/xlwt: Python modules to read and create (not modify) MS Excel files.
• POIFS: a Java library to read and write MS OLE2 files.

Filtering tools and libraries

• ExeFilter: to sanitize MS Office files by removing macros and OLE Package objects.