Microsoft ADV170021: Microsoft Office Defense in Depth Update

Description

Microsoft has released an update for Microsoft Office that provides enhanced security as a defense-in-depth measure. The update disables the Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word. Microsoft is continuing to investigate this issue and will update this advisory as further updates become available. If you are unable to install the update, or if you need to disable the DDE protocol in other Office applications, see Microsoft Security Advisory 4053440. Note that the mitigations listed in the advisory will not disable DDE, but will disable auto-update for any linked fields, including DDE. If you need to change DDE functionality in Word after installing the update, follow these steps: In the Registry Editor navigate to \HKEY_CURRENT_USER\Software\Microsoft\Office<version>\Word\Security AllowDDE(DWORD) Set the DWORD value based on your requirements as follows: AllowDDE(DWORD) = 0: To disable DDE. This is the default setting after you install the update. AllowDDE(DWORD) = 1: To allow DDE requests to an already running program, but prevent DDE requests that require another executable program to be launched. AllowDDE(DWORD) = 2: To fully allow DDE requests. **Update: ** On 1/9/2018, Microsoft released an update for Microsoft Office that adds defense-in-depth configuration options to selectively disable the DDE protocol in all supported editions of Microsoft Excel. If you need to change DDE functionality in Excel after installing the update, follow these steps: In the Registry Editor navigate to \HKEY_CURRENT_USER\Software\Microsoft\Office<version>\Excel\Security DisableDDEServerLaunch(DWORD) Set the DWORD value based on your requirements as follows: DisableDDEServerLaunch = 0: Keep DDE server launch settings unchanged from their initial behavior. This is the default setting after you install the update. DisableDDEServerLaunch = 1: Do not display the dialog that allows users to choose whether to launch a specific DDE server. Instead, behave automatically as though the user chose the default choice of NO. In the Registry Editor navigate to \HKEY_CURRENT_USER\Software\Microsoft\Office<version>\Excel\Security DisableDDEServerLookup(DWORD) Set the DWORD value based on your requirements as follows: DisableDDEServerLookup = 0: Keep DDE server lookup settings unchanged from their initial behavior. This is the default setting after you install the update. DisableDDEServerLookup = 1: Disable querying for DDE Server availability – no query attempt will be made to find DDE servers. .