Every time I want to open LibreOffice there is a mbae exploit notification.

[Nazareno]

"2020-09-06T08:15:29.888-03:00";"PC-Online";"9524";"C:\Program Files\LibreOffice\program\soffice.bin";"6756";"soffice.exe";"1";"512";"210";"0x66FD8820";"";"";"0xCA190000";"0xCA17F000";"";"";"";"";"";""
"2020-09-06T08:15:42.839-03:00";"PC-Online";"7432";"C:\Program Files\LibreOffice\program\soffice.bin";"9172";"C:\Program Files\LibreOffice\program\soffice.bin";"1";"512";"210";"0x66FD8820";"";"";"0xFD790000";"0xFD77F000";"";"";"";"";"";""

 

"2020-09-07T17:02:20.688-03:00";"PC-Online";"4844";"C:\Program Files\LibreOffice\program\soffice.bin";"";"";"1";"512";"210";"0xCA598820";"";"";"0xAAF90000";"0xAAF7F000";"";"";"";"";"";""
"2020-09-07T17:04:01.716-03:00";"PC-Online";"7784";"C:\Program Files\LibreOffice\program\soffice.bin";"";"";"1";"512";"210";"0xCA598820";"";"";"0xE0790000";"0xE077F000";"";"";"";"";"";""
"2020-09-07T17:06:32.095-03:00";"PC-Online";"14696";"C:\Program Files\LibreOffice\program\soffice.bin";"";"";"1";"512";"210";"0xCA598820";"";"";"0x60390000";"0x6037F000";"";"";"";"";"";""
"2020-09-07T17:06:48.248-03:00";"PC-Online";"15104";"C:\Program Files\LibreOffice\program\soffice.bin";"";"";"1";"512";"210";"0xCA598820";"";"";"0xE5990000";"0xE597F000";"";"";"";"";"";""

 

 

This happens with LibreOffice version 7.0.1.2

[Nazareno]

[Nazareno]

great suppot, thanks!

[Living_Computer]

I also have this issue, i don't run the Beta though. I run the normal release.

[Arthi]

Hi,

Thanks for your post.

Can you please turn off the RET ROP Gadget Protection for Office. Let me know if that works for you.

Thanks.

[NoneRain]

Hello, @Arthi, I'm having issues too, but in this case, OpenOffice won't even open.

Tried turning OFF the option you suggested, but no luck... Actually, I turned off everything, but OpenOffice only start if MBAe protection is turned OFF.

Another thing that seems to be not working in this version: Adding a Shield for WPS Office processes (wps.exe for example), as MS Office, also prevents the app execution. Changing it to "Other", makes things work again.

 

 

[Living_Computer]

From my testing (like a month ago, paid and stable) it seems like Libreoffice executables are regarded as "MS Office"

Confusing term.