Office Sustained Engineering

February 2010 Update Release

On Tuesday, February 9th, 2010, Microsoft released 13 security updates.  In Office we are addressing 7 security vulnerabilities with 2 security bulletins.  The security updates apply to:

• Microsoft Office 2002, as described in security bulletin MS10-003
• Microsoft Office PowerPoint 2002 and 2003, described in security bulletin MS10-004

For complete details, see "Microsoft Security Updates for February 2010" for home users and "Microsoft Security Bulletin Summary for February 2010" for IT professionals.

Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter.

We also provide an update for Office 2007 that allows support for .NET Framework 4.0.

January 2010 Update Release

Update Center for Microsoft Office, Office Servers, and Related Products

Before we get into the details of this post, we wanted to quickly call your attention to the new look and feel of this blog.  Hopefully the cleaner site will make our updates easier to follow, and the links to other Office blogs will be useful for you.  Now, on to this post…

The Office Sustaining Engineering team is happy to announce a new website that allows you to track all updates released by Office in a single place.

This Update Center (www.microsoft.com/officeupdatecenter) provides you with a list of the most recent Service Pack, Security Update, and Cumulative Update (Hotfix) releases for each supported version of Office, as well as a list of updates that have been released over the past year.  Additionally, we’ve provided an RSS feed that you can use to receive notifications whenever a new update becomes available.

In the future, we’ll stop using this blog to detail all of the updates that have been released, but rather will post brief notifications that direct users to the information on the Update Center.

Please share your thoughts on the new site using the ‘Click to Rate and Give Feedback’ section at the top of the Update Center itself.  This is our first attempt at creating such a site, so we’d love to hear what you think and will do our best to incorporate your comments.

UPDATE: Cannot Open Office 2003 Documents Protected with RMS

Previously we blogged that starting on December 11, 2009, customers using Office 2003 would not be able to open Office 2003 documents protected with the Active Directory Rights Management Service (AD RMS) or Rights Management Services (RMS). Additionally, customers would not be able to save Office 2003 documents protected with AD RMS/RMS.  A Hotfix package for this issue was released on 12/12/2009. 

In an effort to reach a broader audience, updates are now available through:

Microsoft Update

Download Center

• Office 2003
• Word Viewer
• Excel Viewer

NOTE: Although these updates are available to users of all supported languages, the patch descriptions on the Microsoft Update site and Download Center are in English. Localized versions of these descriptions will be available in early January.

For additional information regarding this issue please explore these Knowledge Base articles:

Office 2003 - KB978551

Word Viewer – KB978558

Excel Viewer – KB978557  

Cannot Open Office 2003 Documents Protected with RMS - Update

Office Client – KB978551 

Word Viewer – KB978558 

Excel Viewer – KB978557

Cannot Open Office 2003 Documents Protected with RMS

Starting on December 11, 2009, customers using Office 2003 will not be able to open Office 2003 documents protected with the Rights Management Service (RMS) or save Office 2003 documents protected with RMS. The following error message may be displayed when attempting to Open RMS Documents using Office 2003:

"Unexpected error occurred. Please try again later or contact your system administrator"

This symptom affects Office 2003 products used in conjunction with RMS, including Word 2003, Excel 2003, PowerPoint 2003 and Outlook 2003. It does not affect Office 2007.

We are working to resolve this issue as quickly as possible and we will provide customers a solution as soon as we can.   Any new updates and we will post the information here.

December 2009 Update Release

On Tuesday, December 8th, 2009, Microsoft released 6 security updates.  In Office we are addressing 2 security vulnerabilities with 2 security bulletins.  The security updates apply to:

1. Microsoft Office Converters 2002, 2003, and Office Converter Pack, described in security bulletin MS09-067.
2. Microsoft Office Project 2000, 2002, and 2003, described in security bulletin MS09-068.

For complete details, see "Microsoft Security Updates for December 2009" for home users and "Microsoft Security Bulletin Summary for December 2009" for IT professionals.

This month you will notice an update is available for the file validation tool currently running with Office 2010.  We are testing the release mechanism for Office 2010.  With this test we are looking for a smooth transition when Office 2010 becomes publicly available.  Here are the locations for x86 and x64 updates.

There will be a new product category under the Office family today on Microsoft Update.  The new category will be titled Office 2010. The Office 2010 product category will include updates for the following categories: service packs, optional updates, and critical updates or security updates.

For additional information on Office 2010 Products see:  http://www.microsoft.com/office/2010/en/default.aspx. 

 ******Office 2010 updates will be available via WSUS after Office 2010 releases (Office 2010 Beta updates are excluded from deployment via the WSUS distribution channel).*********

Microsoft released two updates to the Outlook 2003 and 2007 Junk Email Filter.

November 2009 Update Release

October 2009 Update Release

On Tuesday, October 13th, 2009, Microsoft released 11 security updates for Office addressing 11 security vulnerabilities in two security bulletins. The security updates apply to:

·         Microsoft Office XP, 2003, and 2007, Microsoft Office Outlook 2002, 2003 and 2007, and Microsoft Office Visio Viewer 2007, as described in security bulletin MS09-060.

·         Microsoft Office XP, 2003, and 2007, and Microsoft Visio 2002, as described in security bulletin MS09-062.

For complete details, see "Microsoft Security Updates for October 2009" for home users and "Microsoft Security Bulletin Summary for October 2009" for IT professionals. Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter.

As described in security bulletin MS09-060, Microsoft recommends all users of Visio Viewer 2002 and Visio Viewer 2003 upgrade to the latest version of Visio Viewer 2007 to address this security vulnerability.  Users who are unable to upgrade should apply the update from MS09-034.  This Internet Explorer update mitigates the attack vector for affected Visio Viewer platforms.  Users may also install the cumulative security update for Internet Explorer (MS09-0xx), which provides kill bits for these controls. After you install MS09-060, you will need to upgrade to Visio Viewer 2007 and install the update described in this article to continue using Visio Viewer.

The Security Updates for Microsoft Office XP, 2003 and 2007 described in MS09-060 do not fix a security vulnerability. Instead, they resolve a problem that occurs after you install the Security Updates for Microsoft Office Outlook 2002, 2003 or 2007 described in this bulletin. The Security Updates for Outlook modify the CLSID of the Outlook View Control. This causes certain solutions based on Forms 2.0 that use the Outlook View Control to stop working, such as Business Contact Manager. The Security Updates for Microsoft Office XP, 2003 and 2007 update Forms 2.0 to work properly after the Security Updates to Outlook are installed.

Note: PowerPoint Viewer 2003 has left support as of today. To continue receiving updates, please install PowerPoint Viewer 2007.

September 2009 Update Release

Office Genuine Advantage Update Released

On Tuesday August 25th, 2009, Microsoft released an important/high priority non-security update for Office called Office Genuine Advantage Notifications to assist Microsoft’s efforts to reduce piracy. This update applies to Office XP, 2003 and 2007 suites and applications, and helps users confirm that the copy of Office that is installed on a computer is genuine and correctly licensed. For complete details on this update see “Description of the Office Genuine Advantage Notifications application.”

This update can be obtained using Microsoft Update beginning at 10:00 am PST.

For more information about the ways Microsoft protects customers and partners from the risks of software piracy:

·         Microsoft on the Issues

·         “Microsoft’s Software Protection Platform: Protecting Software and Customers from Counterfeiters”

·         Genuine Microsoft Software

·         How to Tell

Service Pack 2 for 2007 Microsoft Office system begins distribution via Automatic Update the week of September 21, 2009

This is advance notice that we will start providing SP2 for the 2007 Microsoft Office system via Microsoft Update’s Automatic Update the week of September 21, 2009. This continues our commitment to providing a minimum of 30 days notice prior to distributing service packs via this method. The availability will happen gradually over time, completing in early February. This is in response to customer requests as well as to ensure that our service infrastructure can meet the demand for the service pack.

August 2009 Update Release

On Tuesday, August 11th, 2009, Microsoft released three security updates for Office Web Components addressing four security vulnerabilities. The security updates apply to Microsoft Office 2000, XP, and 2003 Web Components, as described in security bulletin MS09-043. These updates address the issue discussed in security advisory 973472. For complete details, see "Microsoft Security Updates for August 2009" for home users and "Microsoft Security Bulletin Summary for August 2009" for IT professionals.

As previously discussed in the post Office Web Components Lifecycle, there are three versions of Office Web Components, and each version was also released as part of the next version of Office. So Office 2000 Web Components released both as part of Office 2000 and part of Office XP. The following table maps the different versions of Office Web Components to the updates needed for those versions:

*Project Server 2007 includes the installation package for the Office 2003 Web Components so that clients who connect to the server can automatically install the Office Web Components. Project Server installations are not vulnerable to the security vulnerability and do not need to install any updates.

**SQL Server 2008 includes  the installation package for the Office 2003 Web Components for use in SQL Server client-side functionality. Most server installations will not contain Office Web Components and will not need to be updated.

Note: Office 2000 is no longer in support.

Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter.

July 2009 Update Release

On Tuesday, July 14th, 2009, Microsoft released one security updates for Office addressing a single security vulnerability. The security update applies to Microsoft Office Publisher 2007, as described in security bulletin MS09-030. For complete details, see "Microsoft Security Updates for July 2009" for home users and "Microsoft Security Bulletin Summary for July 2009" for IT professionals. Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter.

As a reminder, today is the last day of extended support for Microsoft Office 2000. Starting August 1, 2009, Microsoft will discontinue support for Office Update and the Office Update Inventory Tool. To continue getting the latest updates for Microsoft Office products, use Microsoft Update. For more information see the FAQ.

Office Web Components Lifecycle

We often get asked questions about the Office Web Components, commonly known as "OWC", and in particular how the different versions of Office Web Components will be maintained in the future. This post will explain the different versions of Office Web Components that are available and the differences in their lifecycles based on those versions. Office Web Components are most often used to develop custom applications, especially web applications, so if you have never heard of them, this post may not interest you. This post mirrors the content found in Microsoft Knowledge Base article 972129, modified to fit the blog format.

The most important thing to be aware of is that the Office Web Components technology has been deprecated. This means that only security fixes are being made to all versions of OWC, and no future versions of OWC will be produced. If you are using OWC, you should begin migrating to a new technology as soon as possible. For more information, see the blog post "Office Web Components Roadmap". Note that the lifecycle dates given in that blog post are less detailed than those described here. For more information on the Microsoft Support Lifecycle policy, see the Microsoft Support Lifecycle website.

Before we consider the OWC lifecycle, we need to define the different versions of OWC. There have been three versions of Office Web Components: Office 2000 Web Components, Office XP Web Components, and Office 2003 Web Components. Each version released as a web download and on the CDs of the corresponding version of Office. In addition, each version was re-released along with the next version of Office. So there is a version of Office 2000 Web Components on the Office XP CDs and a version of Office XP Web Components on the Office 2003 CDs. The Office 2003 Web Components were not released on Office 2007 CDs, but they were re-released to the web and included with Project Server 2007. Although these re-releases carry the same names and functionality as the original release, for technical reasons they are considered separate products for patching purposes.

This is very important when we consider the product lifecycles for OWC. Each version of OWC, including the re-releases, is supported according to the version of Office with which it shipped. So the version of Office 2000 Web Components that shipped with Office 2000 is in extended support until Office 2000 leaves extended support on July 14^th, 2009, but the version of Office 2000 Web Components that shipped with Office XP is in extended support until Office XP leaves extended support on 7/12/2011. This same rule applies to the other versions of OWC as well. Here are the support milestone dates and release locations for all of the different versions of OWC:

Edit on 8/3/2009: Corrected a typo that incorrectly indicated that the Office 2003 Web Components were not released on Office 2003 CDs. The Office 2003 Web Components were released on Office 2003 CDs but were not released on Office 2007 CDs.