Important - Microsoft Office vulnerability and interim security measures

Dear colleagues,

As you may know, Microsoft has identified a highly rated vulnerability (CVE-2023-36884, CVSS 8.3) in Office. This vulnerability is already being actively exploited to inject malicious code and gain access to systems.

Until a security patch is provided by Microsoft, Microsoft recommends making certain changes to the registry to prevent the vulnerability from being exploited.

We have made a change in our central Active Directory group policy to set the registry keys recommended by Microsoft. The affected registry entries are:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION with the respective applications created as DWORD with the value 1.

The applications are:

- Excel.exe

- Graph.exe

- MSAccess.exe

- MsPub.exe

- PowerPoint.exe

- Visio.exe

- WinProj.exe

- WinWord.exe

- Wordpad.exe

This measure is intended to prevent the vulnerability from being exploited.

Please note that at this stage we are unable to assess whether this change could have any undesirable effects.

In the meantime, we strongly recommend to be careful with unknown or unexpected Office documents and not to open files from unknown senders.

Your RHRZ team