Microsoft Word & Excel (All Versions) RC4 Protection Implementation Flawed

We all know company’s like to detail the algorithms they deploy to ensure our data is safe to help us sleep at night. Microsoft for example employ RC4 to encrypt documents when you password protect them. However what happens when vendors make a mistake on the implementation… well we have just found out..
It would appear all versions of Microsoft Office up to and including Office XP SP3 have a flawed RC4 implementation. This stems from the fact that Microsoft uses the RC4 stream cipher with the same initialization vectors and same keys resulting in the same keystream between document saves. This allows an attacker to retrieve the contents of the document with ease.

This research was conducted by Hongjun Wu and the details are contained in a very good whitepaper here. No patches are currently available so at least in the short term ensure you mitigate the vulnerability through the use of your favorite encryption tool.