Navigate

Check: DTOO150

Microsoft Excel 2013 STIG: DTOO150 (in versions v1 r8 through v1 r6)

Title

The Update of automatic links setting must be configured to prompt user before allowing links to be updated. (Cat II impact)

Discussion

If an Excel workbook contains links to other documents and users are not prompted to approve them, the contents of the workbook might change without the users' knowledge because the linked files have changed. This has the risk of introducing corrupt or malicious content into the document. Prompting the user to update links will allow the content to be updated only with the user's knowledge.

Check Content

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel options -> Advanced -> "Ask to update automatic links" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\software\policies\Microsoft\office\15.0\excel\options\binaryoptions Criteria: If the value fupdateext_78_1 is REG_DWORD = 0, this is not a finding.

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2013 -> Excel options -> Advanced -> "Ask to update automatic links" to "Enabled".

Additional Identifiers

Rule ID: SV-242364r961197_rule

Vulnerability ID: V-242364

Group Title: SRG-APP-000279

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001243	Configure malicious code protection mechanisms to block malicious code; quarantine malicious code; and/or take organization-defined action(s) in response to malicious code detection.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
SI-3	Malicious Code Protection