Pourquoi ce texte est-il en anglais ? Certaines parties de Mactopia sont partagées à l'échelle internationale et ne sont actuellement disponibles qu'en anglais.

Search

GO
 Include End User Assistance

Microsoft Office 2008 for Mac Administrator’s Guide

Introducing Office 2008 for Mac

  Office 2008 Evaluation
  Office 2008 Planning
  Office 2008 Deployment
  Office 2008 Operations
  Office 2008 Security
  Office 2008 Technical Reference
  Office 2008 Known Issues
  Office 2008 Troublehshooting

Messenger Deployment Guide

  Mise en route
  Architecture et planification
  Installation et configuration de Messenger 7 dans un réseau d'entreprise
  Post-installation
  Référence technique

Office 2008 for Mac VPATs

We’re committed to accessibility.

Find out more   You are leaving Microsoft Mactopia

Archives

Download  Office 2004 for Mac Resource Kit

Download  Virtual PC Deployment Guide

Download  Microsoft Messenger for Mac Deployment Guide

Print

Security issue in Office 2008 remote installation to Mac OS X v10.4 (Tiger)

Issue

When you deploy Office 2008 by using a remote connection, such as Apple Remote Desktop, to a client computer at a login window, a postflight script in the Office Installer causes the Dock application to open with root user privileges. Any applications subsequently opened from the Dock will also be run with root user privileges. Under these conditions, someone with physical access to the client computer can gain local elevation of privilege. This security issue can only occur when Office 2008 is deployed to computers that run Mac OS X v10.4.9 or a later version of Mac OS X v10.4 (Tiger). This is not an issue for computers that run Mac OS X v10.5 (Leopard). For more information about this security issue, see Apple KB304131: "Remote Desktop: Installing a package on clients that are at a login window"Click this link to open a browser window.. For information about how to install by using Apple Remote Desktop, see Installation by using Apple Remote Desktop

Solution

Before you use the Office 2008 installer, delete the postflight script file from Office Installer.mpkg/Contents/Packages/Office2008_<language>_dock.pkg/Contents/Resources/. A known issue prevents network deployment of Office 2008 Dock icons. However, a postflight script, which is in the package that attempts to install icons in the Dock, runs successfully. The postflight script causes the Dock application to close and then reopen. To delete the postflight script, perform the following steps:

  1. Copy Office Installer from the Office 2008 DVD to a writable volume.

  2. Hold down CONTROL and click the Office Installer icon.

  3. Click Show Package Contents.

  4. Double-click Contents, and then double-click Packages, and then locate Office2008_<language>_dock.pkg.

    Note Replace <language> with the relevant two-letter language code, such as en, ja, or fr.

  5. Hold down CONTROL and click Office2008_<language>_dock.pkg, and then click Show Package Contents.

  6. Double-click Contents, and then double-click Resources, and then delete postflight.

Mitigations

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, which could reduce the severity of exploitation of vulnerability. The following mitigating factors may be helpful in your situation:

  • Mac OS X v10.5 (Leopard) is not vulnerable to this issue.

  • Restarting the client computers after the installation removes the vulnerability.

  • If you use Apple Remote Desktop 3 or later to deploy Office 2008, choose the options to lock the screens during installation. If the screen is locked during installation, then this vulnerability is not exposed.

Note For an introduction to Apple Remote Desktop, see Apple Remote Desktop 3Click this link to open a browser window. on the Apple Web site (www.apple.com/remotedesktop). For detailed information, see the Apple Remote Desktop Administrator's GuideClick this link to open a browser window. documentation available for download from the Resources page in the same area of the Apple Web site.

Your feedback was not submitted because the network connection was lost. Verify that you have an Internet connection, and then try submitting your feedback.

If you are still unsuccessful, the feedback server might be temporarily disconnected. Try submitting your feedback later.