STIGQter STIGQter: STIG Summary: Microsoft Office 365 ProPlus Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The load of controls in Forms3 must be blocked.

DISA Rule

SV-223295r684247_rule

Vulnerability Number

V-223295

Group Title

SRG-APP-000207

Rule Version

O365-CO-000013

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Set the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Load Controls in Forms3" to "Enabled:1".

Check Contents

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Load Controls in Forms3" is set to Enabled and 1 from drop down. (For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration.)".

Use the Windows Registry Editor to navigate to the following key:

HKCU\keycupoliciesmsvbasecurity

If the value LoadControlsInForms is REG_DWORD=1, this is not a finding.

Vulnerability Number

V-223295

Documentable

False

Rule Version

O365-CO-000013

Severity Override Guidance

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2016 >> Security Settings "Load Controls in Forms3" is set to Enabled and 1 from drop down. (For a UFI or SFI signed control that supports safe and unsafe mode, load the control in unsafe mode. For an SFI signed control that only supports a safe mode configuration, load the control in safe mode. This option enforces the default configuration.)".

Use the Windows Registry Editor to navigate to the following key:

HKCU\keycupoliciesmsvbasecurity

If the value LoadControlsInForms is REG_DWORD=1, this is not a finding.

Check Content Reference

M

Target Key

4099

Comments