Microsoft Offers Workaround for Office 2008 Security Flaw

by , 11:10 AM EST, January 28th, 2008

Following the report that Office 2008 for the Mac improperly set permissions during installation, and Microsoft's confirmation of the issue, the company is offering a work around until a permanent fix is available.

Microsoft's Erik Schwiebert stated on the mactopia blog that the "issue is that our installer is incorrectly granting ownership of the files to a particular local user as it installs them, so that if your Mac actually has a second local user and that user is not an administrator on your Mac, they could modify your Office 2008 install."

Fix temporary fix, according to the blog entry, involves modifying certain file and directory permissions from Terminal. Here's how:

• Launch Terminal. It's in Applications/Utilities.
• Enter this command: /usr/bin/sudo /bin/chmod -R a-st "/Applications/Microsoft Office 2008" "/Library/Automator" "/Library/Fonts/Microsoft" "/Library/Application Support/Microsoft"
• Press return
• Enter the password for the account you used when installing Office 2008 when prompted.
• Enter this command: /usr/bin/sudo /usr/sbin/chown -h -R root:admin "/Applications/Microsoft Office 2008" "/Library/Automator" "/Library/Fonts/Microsoft" "/Library/Application Support/Microsoft"
• Press return
• You may be prompted for your password again. If so, be go ahead and enter it.

Mr. Schwiebert added "The MacBU is working on an update to Office 2008 that will automatically fix the file ownership for you. This update will be made available via Microsoft's AutoUpdate tool and via a web download."

Microsoft has not stated when the official fix will be available.