Title

Save files default format as backward compatible, not as XML. (Cat II impact)

Discussion

By default, Excel 2007 saves new workbooks in the Office Open XML format with an .xlsx extension. For users who run Excel 2000 with Service Pack 3, Excel 2002 with Service Pack 3, and Excel 2003 with at least Service Pack 1, Microsoft offers the Microsoft Office Compatibility Pack, which enables these versions of Excel to open and save .xlsx files. If some users in your organization cannot install the Compatibility Pack, or are running versions of Excel older than Excel 2000 with Service Pack 3, these users might not be able to access Excel files saved in the .xlsx format.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Office Excel 2007 -> Excel Options -> Save "save excel files as" will be set to "Enabled (Excel 97-2003 Workbook(*.xls)" or "Enabled (Excel Workbook *.xlsx"). Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\12.0\Excel\Options Criteria: If the value DefaultFormat is REG_DWORD = 38 (hex) or 56 (Decimal) for Excel 97-2003 or If the value DefaultFormat is REG_DWORD = 33 (hex) or 51 (Decimal) for 2007 .xlsx , this is not a finding.

Fix Text

The policy value for User Configuration -> Administrative Templates -> Microsoft Office Excel 2007 -> Excel Options -> Save "save excel files as" will be set to "Enabled (Excel 97-2003 Workbook(*.xls)" or "Enabled (Excel Workbook *.xlsx").

Additional Identifiers

Rule ID: SV-18606r1_rule

Vulnerability ID: V-17521

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.