Title

Internet links and Network UNCs created as embedded hyperlinks must be prevented. (Cat II impact)

Discussion

When users type a string of characters, Excel recognizes as a Uniform Resource Locator (URL) or Uniform Naming Convention (UNC) path to a resource on the Internet or a local network, Excel will transform it into a hyperlink. Clicking the hyperlink opens it in the configured default Web browser or the appropriate application. This functionality can enable users to accidentally create links to dangerous or restricted resources, which could create a security risk.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2010 -> Excel Options -> Proofing -> Autocorrect Options “Internet and network paths as hyperlinks” must be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\14.0\excel\options If the value AutoHyperlink is REG_DWORD = 0, this is not a finding.

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2010 -> Excel Options -> Proofing -> Autocorrect Options “Internet and network paths as hyperlinks” to “Disabled”.

Additional Identifiers

Rule ID: SV-33436r1_rule

Vulnerability ID: V-17650

Group Title: DTOO138 - Internet and Network Path hyperlinks

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.