MWB 4.4.5 Blocks & Crashes LibreOffice 7.2

[JackDeth]

If you open LibreOffice and click on TOOLS \ ADVANCED the program crashes.

From the error log it appears it might be blocking something to do with Java. I installed the latest Java runtime and it still crashes. It will still crash even if I tell LibreOffice not to use Java. It's something to do with that dialogue box in LibreOffice, I think.

 

Error.txt

[Arthi]

Hi JackDeth,

Thanks for posting. Please open Malwarebytes and go to Settings, Security and scroll to the bottom and click the Advanced Settings button.

In the next dialog box go to the Application behavior protection tab and on the MS Office column try unchecking "Office scripting app abuse protection"

Hope that helps, Thanks.

[JackDeth]

That seems to work. Thanks.

[cpcfreak]

I can confirm this is still happening with 4.4.6 and LibreOffice 7.2.0.4 x64.

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 19/09/2021
Protection Event Time: 13:37
Log File: dc754986-18fa-11ec-8b53-001a7dda7103.json

-Software Information-
Version: 4.4.6.132
Components Version: 1.0.1453
Update Package Version: 1.0.45096
Licence: Premium

-System Information-
OS: Windows 10 (Build 19043.1237)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, C:\Program Files\Java\jre1.8.0_301\bin\java.exe -classpath C:\Program Files\LibreOffice\program JREProperties, Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: LibreOffice
Protection Layer: Application Behavior Protection
Protection Technique: Exploit Office scripting abuse blocked
File Name: C:\Program Files\Java\jre1.8.0_301\bin\java.exe -classpath C:\Program Files\LibreOffice\program JREProperties
URL: 

(end)

[JackDeth]

I will admit, the solution I accepted isn't technically a solution. It's a temporary workaround that prevents the program from crashing.

Should I unmark the solution as no longer accepted?

[cpcfreak]

It's an interesting issue.

Some users may have both MS Office and LibreOffice installed, so I suppose the workaround isn't viable in those instances as it's an over-ride for default security settings.

End users of Firebird RDBMS have to access LibreOffice Tools/Options/Advanced to enable experimental features allowing Firebird RDBMS to be selected as the LibreOffice Base backend, but that doesn't mean the same users won't want MS Office Scripting Exploits protected. In my cases I'm authoring reports and administering a database that I need to do sporadic development work in both LibreOffice via JDBC and MS Office via ODBC, so I frequently flip between the two to make sure my changes do not break one or the other. I can turn off that option to work but it's not viable for me to direct many other users to disable default protections.

FWIW, I recall something similar several MB versions back, that was resolved but perhaps it has returned in 4.4.5 and beyond.

[Arthi]

Hi cpcfreak, JackDeth,

Thanks for your post. In our latest release, we have enhanced some Exploit protections according to our research into the latest threat landscape as well as provide customers with granular settings so it can be turned off/on according to their working environment.

If you would like Libreoffice to continue to allow execution of scripts applications but protect MS Office applications from doing so, you can always turn off Libreoffice as a protected application while keeping the above mentioned setting ON, so only MS Office applications are protected against scripting app abuse.

Please let me know if you have any further questions. Thank you.