Gratuitously enabling embedding stuff like this in applications which don't really need it makes me always shudder when some software vendor is touting buzzwords like 'rich content' and 'rich user experience'. Most of the times it means unnecessary bloat, and as we can see from this example, a security hole too.
To Microsoft's credit, running embedded ActiveX objects in Office is switched off by default. In large enterprise networks this can be set as part of a group policy. EMC must have switched it on. There is no granularity to it where you can say 'enable activex for video files but not for flash', so it is all or nothing.
What you can do is set it to only allow embedded loads from the 'trusted' network, for eg. the intranet (a great feature which is rarely used). The reason why they attacked with an ActiveX exploit in an office document instead of a web page is because the office documents allow you to embed the entire object so that it is loaded locally - but newer Windows will still know that the original source is from the web, so it will treat it as such. EMC must have had liberal group policies.
But you see the situation often - sales guys receive powerpoint presentations with embedded objects, or are creating them, and need it enabled.
You can review the various objects you have registered in windows by going to HKEY_CLASSES_ROOT\CLSID in your registry, or using a tool such as:
http://www.nirsoft.net/utils/axhelper.html
To change your Office security settings, see this msft article:
http://office.microsoft.com/en-us/word-help/enable-or-disabl...
Edit: just to add, OLE is just the old ActiveX. OLE on COM was very difficult to implement - so Microsoft stripped it down, simplified it and called the new set of interfaces ActiveX.
I think Windows uses alternate data streams to mark files as coming from the web, if the web server is Unix it can't, and will not do such a thing. Files will apear as coming from the intranet.
Doesn't that depend on the e-mail client / browser rather than the server? The client will mark the file as downloaded from the internet when downloading it. The data in the HTTP protocol is not altered.
/edit: to the guys downvoting, does anyone really think running arbitrary, unknown code is a good idea?
IIRC, by default, only intranet apps would be allowed to run ActiveX controls that were signed. Internet apps would prompt a warning - but as we all know now, users just clicked through them and enabled them to run.
ActiveX itself is very nice and very simple - it is, after all, just a documented interface for components.
It allowed us to port all those enterprise desktop apps into the browser. We had very efficient and fast web applications running in the browser long before the ajax revolution that came some years later. It completely changed the cost of IT and administration for a large number of businesses - you no longer had to maintain all these different custom-built desktop applications for every business unit - you just pointed their browser to the web app (we all know these advantages today, but back then it was completely revolutionary).
You couldn't do it with just HTML then, you can now thanks for the new input types, xmlhttprequest (from Microsoft) etc.