OpenOffice.org Spurns Security Worries

OpenOffice.org has rejected accusations that its open-source application suite is at least as susceptible to attack as Microsoft's Office in a terse statement posted on its Web site.

"The OpenOffice.org community confirms it regards security as of the highest importance and will react immediately to any security issues," the statement read.

In a study conducted by the French Ministry of Defense's Signal Corps, researchers alleged that the danger from viruses and worms to OpenOffice.org is at least as high as for Microsoft Office, and may be higher.

The charges are of particular importance in Europe, where OpenOffice.org has gained traction in government circles as agencies try to wean themselves from the proprietary document formats used by Microsoft Office. In France, government users of the open-source suite include the Ministry of Defense.

French researchers were particularly concerned with macro security in OpenOffice.org, and pegged the problems as ones "at the conceptual level" of the suite.In early June, OpenOffice.org disputed the use of the term "virus" to describe a macro exploit against the suite, and said it would not patch the problem. As far back as 2003, security researchers have warned that exploits using the suite's macro language were possible, and called the applications' default macro security settings as "resembling older versions of Microsoft Office."

OpenOffice.org's statement also took issue with the way that the security concerns were leaked. "If security vulnerabilities are suspected, there is a well defined procedure within the IT industry for reporting, analyzing, and resolving any issues, which aims to minimize any public announcement (and the resulting creation of exploits) until fixes are available," the statement read.

Microsoft regularly blasts vulnerability disclosures it considers inappropriate in much the same language.

"The OpenOffice.org office suite is being widely adopted within the French public administration, and the OpenOffice.org community has been working closely with the departments involved. OpenOffice.org is pleased that its source code is being scrutinized by the most important and respected department of security in France," the group's statement concluded.

OpenOffice.org can be downloaded in versions for Windows, Linux, Solaris, Mac OS X, and FreeBSD from the organization's Web site.0