Title

Open/Save actions for dBase III / IV files must be blocked. (Cat II impact)

Discussion

This policy setting allows for determining whether users can open, view, edit, or save Excel files with the format specified by the title.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2010 -> Excel Options -> Security -> Trust Center -> File Block Settings “dBase III / IV files” must be “Enabled: Open/Save blocked, use open policy". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\14.0\excel\security\fileblock Criteria: If the value DBaseFiles is REG_DWORD = 2, this is not a finding.

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2010 -> Excel Options -> Security -> Trust Center -> File Block Settings “dBase III / IV files” to “Enabled: Open/Save blocked, use open policy".

Additional Identifiers

Rule ID: SV-34230r1_rule

Vulnerability ID: V-26595

Group Title: DTOO122 - dBase III / IV files

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.