Microsoft Security Advisory: Microsoft Office File Validation for Office 2003, 2007 Office, and Office 2010: April 12, 2011

Article ID: 2501584 - View products that this article applies to.
Expand all | Collapse all

On This Page

Introduction

Office File Validation (OFV) is a security feature that was introduced in Microsoft Office 2010. Office File Validation verifies that a particular binary file complies with the application’s expectations. Office File Validation can help prevent unknown binary file format attacks against Microsoft Office 97-2003 file formats. 

When you open Microsoft Office 97-2003 binary file (such as .doc) the file is compared to a binary schema. If the file fails this validation, you are notified that the document could be considered to be compromised. In Office 2003 and in the 2007 Office system, you are prompted about the file status and can decide to cancel opening the file or to continue to open the file.
Back to the top | Give Feedback

MORE INFORMATION

To help protect your computer from risk, we recommend that you do not open files that you receive as email message attachments, especially if the messages arrive unexpectedly. Additionally, do not open files that you receive as attachments if the files are from a person who is unknown to you.

For Enterprise customers visit the following TechNet webpage:
Office File Validation for Office 2003 and Office 2007
(http://technet.microsoft.com/en-us/library/53782285-736e-4d00-b458-6170054287af.aspx)

Install Office File Validation

Prerequisites

To install Office File Validation, you must have the following prerequisites:
  • You must have Office 2003, the 2007 Office system, or Office 2010 installed.
  • You must have all recommended updates for all Office programs. To install all recommended updates, visit the Microsoft Update website:
    Microsoft Update
    (http://update.microsoft.com/microsoftupdate/v6/default.aspx)
  • You must install the following architecture updates to Microsoft Publisher before you install Office File Validation:

Install Office File Validation

The following file is available for download from the Microsoft Download Center:

Collapse this imageExpand this image
Download
Download the Office File Validation package now.
(http://www.microsoft.com/downloads/details.aspx?FamilyID=6a4e39a4-4c3f-4cc7-98ec-1cb2d5cb5881)


Release Date: April 12, 2011

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591
(http://support.microsoft.com/kb/119591/ )
How to obtain Microsoft support files from online services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Known issues with Office File Validation

  • Files that were created in Microsoft Excel 2.0, Microsoft Excel 3.0, or Microsoft Excel 4.0 will fail validation when you use Office File Validation in Office 2003.
  • Solver.xla will fail validation when you use Office File Validation in Office 2003.
  • When you paste lots of charts or points of data into an Office 2003 document, the paste function may take a long time to complete while Office File Validation tries to validate the new data.
  • Opening files from a network share that have many charts or points of data will take longer to open in Office 2003.

    For more information about this issue, click the following article number to view the article in the Microsoft Knowledge Base:
    2570623
    (http://support.microsoft.com/kb/2570623/ )
    Excel 2003 Office File Validation (OFV) opens workbooks slower across the network
Microsoft is researching these issues and will post more information in this article when the information becomes available.

Default Behavior

When you try to open a Word, Excel, PowerPoint, or Publisher 97-2003 file, and that file fails Office File Validation, you receive the following warning:

Collapse this imageExpand this image
Office File Validation detected a problem while trying to open this file. Opening it may be dangerous.


Fix it for me

For Office 2010

To prevent files from being opened that have failed validation, you can use the following Fix it solutions.
Disable Edit in Protected View
Excel 2010
Fix this problem
Microsoft Fix it 50658

PowerPoint 2010
Fix this problem
Microsoft Fix it 50660

Word 2010
Fix this problem
Microsoft Fix it 50662
Enable Edit in Protected View
Excel 2010
Fix this problem
Microsoft Fix it 50659
PowerPoint 2010
Fix this problem
Microsoft Fix it 50661
Word 2010
Fix this problem
Microsoft Fix it 50663

For Office 2003 and 2007 Office system

To prevent files from being opened that have failed validation you can use the following Fix it solutions.
Disable the opening of documents
Excel 2003 and 2007
Fix this problem
Microsoft Fix it 50625
Word 2003 and 2007
Fix this problem
Microsoft Fix it 50646
PowerPoint 2003 and 2007
Fix this problem
Microsoft Fix it 50648
Enable the editing of documents
Excel 2003 and 2007
Fix this problem
Microsoft Fix it 50645
Word 2003 and 2007
Fix this problem
Microsoft Fix it 50647
PowerPoint 2003 and 2007
Fix this problem
Microsoft Fix it 50649

Let me fix it myself

For Office 2010

You can manually set the registry entries by using the following values:
Value: DisableEditFromPV
Type: REG_DWORD
Default value: 0
Description: When Office File Validations fails
0 = Enable Edit in Protected View.
1 = Disable Edit in Protected View.
Add the DisableEditFromPV REG_DWORD to any or all the following registry subkeys to disable Edit in Protected View in Office 2010:
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\FileValidation

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Security\FileValidation

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\FileValidation

For the 2007 Microsoft Office system and Office 2003

You can manually set the registry entries by using the following values:

Value: InvalidFileUIOptions
Type: REG_DWORD
Default value: 0
Description: When Office File Validations fails
0 = Notify user file failed. Give user the option to load the file or not
1 = Notify user file failed. No option to load the file.
For the 2007 Microsoft Office system
Add the InvalidFileUIOptions REG_DWORD to any or all the following registry subkeys for Office File Validation in 2007 Microsoft Office system:

HKEY_CURRENT_USER\Software \Microsoft\Office\12.0\Excel\Security\FileValidation

HKEY_CURRENT_USER\Software \Microsoft\Office\12.0\Word\Security\FileValidation

HKEY_CURRENT_USER\Software \Microsoft\Office\12.0\PowerPoint\Security\FileValidation
For Office 2003
Add the InvalidFileUIOptions REG_DWORD to any or all the following registry subkeys for Office File Validation in Office 2003:
HKEY_CURRENT_USER\Software \Microsoft\Office\11.0\Excel\Security\FileValidation

HKEY_CURRENT_USER\Software \Microsoft\Office\11.0\Word\Security\FileValidation

HKEY_CURRENT_USER\Software \Microsoft\Office\11.0\PowerPoint\Security\FileValidation
Back to the top | Give Feedback

Properties

Article ID: 2501584 - Last Review: June 21, 2012 - Revision: 5.0
APPLIES TO
  • Microsoft Office Home and Business 2010
  • Microsoft Office Home and Student 2010
  • Microsoft Office Professional 2010
  • Microsoft Office Professional Academic 2010
  • Microsoft Office Professional Plus 2010
  • Microsoft Office Professional Plus 2010 Home Use Program
  • Microsoft Office Standard 2010
  • Microsoft Office Starter 2010
  • Microsoft Excel 2010
  • Microsoft Excel Home and Student 2010
  • Microsoft PowerPoint 2010
  • Microsoft PowerPoint Home and Student 2010
  • Microsoft Publisher 2010
  • Microsoft Word 2010
  • Microsoft Word Home and Student 2010
  • Microsoft Office Basic 2007
  • Microsoft Office Enterprise 2007
  • Microsoft Office Enterprise 2007 Home Use Program
  • Microsoft Office Professional 2007
  • Microsoft Office Professional Plus 2007
  • Microsoft Office Small Business 2007
  • Microsoft Office Standard 2007
  • Microsoft Office Excel 2007
  • Microsoft Office Excel 2007 (Home and Student version)
  • Microsoft Office PowerPoint 2007
  • Microsoft Office PowerPoint 2007 (Home and Student version)
  • Microsoft Office Publisher 2007
  • Microsoft Office Word 2007
  • Microsoft Office Word 2007 (Home and Student version)
  • Microsoft Office Professional Edition 2003
  • Microsoft Office Standard Edition 2003
  • Microsoft Office Professional Enterprise Edition 2003
  • Microsoft Office Small Business Edition 2003
  • Microsoft Office Student and Teacher Edition 2003
  • Microsoft Office Excel 2003
  • Microsoft Office PowerPoint 2003
  • Microsoft Office Publisher 2003
  • Microsoft Office Publisher 2003 with Digital Imaging
  • Microsoft Office Word 2003
Keywords: 
kbexpertiseinter kbqfe kbsecurity kbsecbulletin kbsecvulnerability kbbug kbfix kbsurveynew KB2501584
Back to the top | Give Feedback

Give Feedback

 
Back to the topBack to the top