File Validation from Office 2010 to Office 2003 and Office 2007

In mid-December 2010, Microsoft announced that it was planning to backport a piece of the security evolution of Office 2010 to two of the productivity suite’s predecessors. In order to increase the level of protection enjoyed by customers running Office 2007 and Office 2003 when opening documents problematic, security-wise, the Redmond company decided to also tailor File Validation for the two versions of Office.

Both Office 2003 and Office 2007 will get Office 2010;s File Validation security feature in the first quarter of 2011, the software giant stated in December 2010, a deadline which was re-confirmed this week, by Modesto Estrada, a member of the Microsoft Office Sustained Engineering Security team.

Estrada also delivered insight into just what the backporting of File Validation from Office 2010 to Office 2003 and Office 2007 will mean for users.

“When we were creating the dialog boxes for failed file validation, it is a general concern that users have grown accustomed to dialog boxes, and click through them without even reading the message,” Estrada explained.

“In an effort to dissuade any apathy, we’ve taken a more aggressive stance by communicating the potential for malicious intent.

“When a user opens a Word, Excel, PowerPoint, or Publisher 97-2003 file (what happens during the open), and that file fails Office File Validation the user will be presented with the dialog box [on the left] (this is the Default Behavior).”

But it’s critical to note that neither Office 2003 nor Office 2007 will become as secure as Office 2010 just because of File Validation.

As users running Office 2010 already know, File Validation is used in conjunction with Protect View on their machines.

This means that documents can be opened in a secure manner, and that any potential attacks they contain will not be able to compromise the computer, as the doc runs in a sandboxed environment.

But File Validation and Protect Mode are not one and the same thing, and Office 2007 and Office 2003 will only get the first, not the latter.

File Validation “will allow the user the ability to either cancel or continue opening the document. In this situation we strongly recommend that the user select cancel and notify the creator or sender of the document’s potential issues,” Estrada added.

Office Home and Business 2010 RTM Build 14.0.4760.1000 is available for download here.

Office Home and Student 2010 RTM Build 14.0.4760.1000 is available for download here.

Office Professional 2010 RTM Build 14.0.4760.1000 is available for download here.