Problem with Office table stream

[Weijen]

Hello,

I'm working on a malware detection project. It seems the recent document
vulnerabilities are in the MS Office table stream (1Table and 0Table), but
the data format is too complex to understand. I understand the OLE2
structure, but don't know the details in the 1Table stream. Is there any
documentation that I can learn about this data format? or is this the right
place for this question?
Thank you very much.

Weijen

 

[Tony Jollans]

This isn't really the right place to ask this question - it has nothing to
do with Tables in Documents. Perhaps
microsoft.office.developer.binary.file_format - but that's a very low
activity group.

I don't have a real answer for you, but Microsoft do make some documentation
available in a rather roundabout way (and have promised to make it more
easily available shortly). See http://support.microsoft.com/kb/840817/en-us
(the last section of the page) . I know nothing about malware or the
document vulnerabilities you mention and I haven't seen the Microsoft
documentation so I have no idea whether it will help.