OpenOffice.org, the open-source project that produces an alternative to Microsoft's Office suite, said it won't patch its software against a recently launched macro threat.
In a statement prominently displayed on the OpenOffice.org home page, the group also disputes applying the label "virus" to Stardust, the proof-of-concept exploit discovered last week by Kaspersky Labs.
"The 'proof-of-concept macro virus' showed that it is possible to write a simple 'virus-like' program using OpenOffice.org's macro language," read the statement. "This is a known risk with any capable macro language. To mitigate against this risk, by default OpenOffice.org detects if a document contains macros, displays a warning, and will only run the macro if the user specifically agrees. This behavior conforms to industry best practice."
The statement went on to say that the suite won't be patched, and by implication, that the software's macro security feature won't be changed.
"The OpenOffice.org engineers take the security of the software very seriously, and will react promptly to any new issues [but] this 'proof-of-concept' virus is not new information, and does not require a software patch. Technically, it is not even a virus, as it is not 'self-replicating' - with OpenOffice.org's default settings, it cannot spread without user intervention."
