Re: [Full-Disclosure] Gnumeric and Applix can modify locked Excel files?

[psz@xxxxxxxxxxxxxxxxx (Paul Szabo)]

Dave Horsfall <dave@xxxxxxxxxxxx> wrote:

> I found I was able to modify a supposedly password-locked Excel file
> without the password, with Gnumeric (a free *nix clone of Excel) and
> Applix (a commercial *nix clone of Office).

Similar issues have been discussed previously, in the context of Word.
Quoting from my

  http://www.maths.usyd.edu.au:8000/u/psz/securepc.html#MSOffice

page:

  Microsoft Word Protection Bypass
  http://www.securityfocus.com/archive/1/348692
  http://www.securityfocus.com/archive/1/349157 
  Though
  
http://www.microsoft.com/technet/prodtechnol/office/office2000/reskit/ork2000/html/65t2_2.asp
  says that Password to Modify uses encryption,
  http://support.microsoft.com/?kbid=822924
  admits that it also may be bypassed; and
  http://www.microsoft.com/technet/columns/security/askus/auas0301.asp
  knew that already in 2001...

Is the Excel issue related?

Cheers,

Paul Szabo - psz@xxxxxxxxxxxxxxxxx  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html