Office Sustained Engineering : Security

November 2009 Update Release

The Microsoft Office Sustained Engineering Team — Tue, 10 Nov 2009 17:42:00 GMT

On Tuesday, November 10th, 2009, Microsoft released 6 security updates. In Office we are addressing 11 security vulnerabilities with 2 security bulletins. The security updates apply to:

Microsoft Office Excel 2002, 2003, 2007, Excel Viewer 2003, Excel Viewer, and the 2007 Microsoft Office System, described in security bulletin MS09-067.
Microsoft Office Word 2002, 2003, and Word Viewer 2003 as described in security bulletin MS09-068.

For complete details, see "Microsoft Security Updates for November 2009" for home users and "Microsoft Security Bulletin Summary for November 2009" for IT professionals.

Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter.

October 2009 Update Release

The Microsoft Office Sustained Engineering Team — Thu, 08 Oct 2009 21:36:00 GMT

On Tuesday, October 13th, 2009, Microsoft released 11 security updates for Office addressing 11 security vulnerabilities in two security bulletins. The security updates apply to:

· Microsoft Office XP, 2003, and 2007, Microsoft Office Outlook 2002, 2003 and 2007, and Microsoft Office Visio Viewer 2007, as described in security bulletin MS09-060.

· Microsoft Office XP, 2003, and 2007, and Microsoft Visio 2002, as described in security bulletin MS09-062.

For complete details, see "Microsoft Security Updates for October 2009" for home users and "Microsoft Security Bulletin Summary for October 2009" for IT professionals. Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter.

As described in security bulletin MS09-060, Microsoft recommends all users of Visio Viewer 2002 and Visio Viewer 2003 upgrade to the latest version of Visio Viewer 2007 to address this security vulnerability. Users who are unable to upgrade should apply the update from MS09-034. This Internet Explorer update mitigates the attack vector for affected Visio Viewer platforms. Users may also install the cumulative security update for Internet Explorer (MS09-0xx), which provides kill bits for these controls. After you install MS09-060, you will need to upgrade to Visio Viewer 2007 and install the update described in this article to continue using Visio Viewer.

The Security Updates for Microsoft Office XP, 2003 and 2007 described in MS09-060 do not fix a security vulnerability. Instead, they resolve a problem that occurs after you install the Security Updates for Microsoft Office Outlook 2002, 2003 or 2007 described in this bulletin. The Security Updates for Outlook modify the CLSID of the Outlook View Control. This causes certain solutions based on Forms 2.0 that use the Outlook View Control to stop working, such as Business Contact Manager. The Security Updates for Microsoft Office XP, 2003 and 2007 update Forms 2.0 to work properly after the Security Updates to Outlook are installed.

Note: PowerPoint Viewer 2003 has left support as of today. To continue receiving updates, please install PowerPoint Viewer 2007.

August 2009 Update Release

The Microsoft Office Sustained Engineering Team — Fri, 07 Aug 2009 09:47:00 GMT

On Tuesday, August 11th, 2009, Microsoft released three security updates for Office Web Components addressing four security vulnerabilities. The security updates apply to Microsoft Office 2000, XP, and 2003 Web Components, as described in security bulletin MS09-043. These updates address the issue discussed in security advisory 973472. For complete details, see "Microsoft Security Updates for August 2009" for home users and "Microsoft Security Bulletin Summary for August 2009" for IT professionals.

As previously discussed in the post Office Web Components Lifecycle, there are three versions of Office Web Components, and each version was also released as part of the next version of Office. So Office 2000 Web Components released both as part of Office 2000 and part of Office XP. The following table maps the different versions of Office Web Components to the updates needed for those versions:

OWC Version	From Product	Patch Needed
2000	Office XP	KB947320
XP (2002)	Office XP, web download	KB947320
XP (2002)	Office 2003	KB947319
2003	Office 2003, web download (versions 1-3)	KB947319
2003	Web download (version 4), Project Server 2007, SQL Server 2008*	KB947318

*Project Server 2007 includes the installation package for the Office 2003 Web Components so that clients who connect to the server can automatically install the Office Web Components. Project Server installations are not vulnerable to the security vulnerability and do not need to install any updates.

**SQL Server 2008 includes the installation package for the Office 2003 Web Components for use in SQL Server client-side functionality. Most server installations will not contain Office Web Components and will not need to be updated.

Note: Office 2000 is no longer in support.

Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter.

July 2009 Update Release

The Microsoft Office Sustained Engineering Team — Tue, 14 Jul 2009 08:35:00 GMT

On Tuesday, July 14th, 2009, Microsoft released one security updates for Office addressing a single security vulnerability. The security update applies to Microsoft Office Publisher 2007, as described in security bulletin MS09-030. For complete details, see "Microsoft Security Updates for July 2009" for home users and "Microsoft Security Bulletin Summary for July 2009" for IT professionals. Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter.

As a reminder, today is the last day of extended support for Microsoft Office 2000. Starting August 1, 2009, Microsoft will discontinue support for Office Update and the Office Update Inventory Tool. To continue getting the latest updates for Microsoft Office products, use Microsoft Update. For more information see the FAQ.

June 2009 Update Release

The Microsoft Office Sustained Engineering Team — Mon, 08 Jun 2009 21:31:00 GMT

On Tuesday, June 9th, 2009, Microsoft released 17 security updates for Office in 3 bulletins addressing 11 security vulnerabilities. The security updates apply to the following products:

Microsoft Office Excel 2000, 2002, 2003, 2007, Excel Viewer 2003, Excel Viewer, the Microsoft Office Compatibility Pack, the 2007 Microsoft Office System, and Excel Services in Microsoft Office SharePoint Server 2007 (32 bit, 64 bit), as described in security bulletin MS09-021.
Microsoft Office Word 2000, 2002, 2003, 2007, Word Viewer 2003, the Microsoft Office Compatibility Pack, and the 2007 Microsoft Office System, as described in security bulletin MS09-027.
Microsoft Office 2000, XP, and 2007, as described in security bulletin MS09-024.

For complete details, see "Microsoft Security Updates for June 2009" for home users and "Microsoft Security Bulletin Summary for June 2009" for IT professionals.

Microsoft also released two updates to the Outlook 2003 and 2007 Junk Email Filter and an update to Outlook. The update to Outlook resolves an issue that occurs when you attempt to save after you edit a meeting request with Service Pack 2 installed. If certain fields, such as the list of meeting attendees, are edited, you will be prompted to either save and notify the meeting attendees or not save. If you choose not to save, your changes are lost. This update resolves that issue. The update, which will install successfully if either Service Pack 1 or Service Pack 2 is installed, also delivers many of the Outlook performance enhancements in Service Pack 2 to users who are not yet ready to install the service pack.

Starting August 1, 2009, Microsoft will discontinue support for Office Update and the Office Update Inventory Tool. To continue getting the latest updates for Microsoft Office products, use Microsoft Update. For more information see the FAQ.

May 2009 Update Release

The Microsoft Office Sustained Engineering Team — Fri, 08 May 2009 02:52:00 GMT

On Tuesday, May 12th, 2009, Microsoft released 7 security updates for Office in 1 bulletin addressing 14 security vulnerabilities. The security updates apply to the following products:

Microsoft Office PowerPoint 2000, 2002, 2003, 2007, PowerPoint Viewer 2003, PowerPoint Viewer 2007, the Microsoft Office Compatibility Pack, and the 2007 Microsoft Office System, as described in security bulletin MS08-017. These updates address the issue described in Microsoft Security Advisory 969136.

For complete details, see "Microsoft Security Updates for May 2009" for home users and "Microsoft Security Bulletin Summary for May 2009" for IT professionals.

April 2009 Update Release

The Microsoft Office Sustained Engineering Team — Tue, 07 Apr 2009 00:41:00 GMT

On Tuesday, April 14th, 2009, Office released 10 security updates in 2 bulletins addressing a total of 4 security vulnerabilities. The security updates apply to the following products:

Microsoft Office Excel 2000, 2002, 2003, 2007, Excel Viewer 2003, Excel Viewer, the Microsoft Office Compatibility Pack, and the 2007 Microsoft Office System, as described in security bulletin MS08-009. These updates address the issue described in Microsoft Security Advisory 968272.
Microsoft Office Converters 2000 and 2002, as described in security bulletin MS08-010. These updates fix issues related to Microsoft Security Advisory 960906.

For complete details, see "Microsoft Security Updates for April 2009" for home users and "Microsoft Security Bulletin Summary for April 2009" for advanced users.

February 2009 Update Release

The Microsoft Office Sustained Engineering Team — Tue, 10 Feb 2009 21:00:00 GMT

On Tuesday, February 10^th, 2009, Office released 3 security updates in 1 bulletin addressing 3 security vulnerabilities. The security updates apply to Microsoft Office Visio 2002, 2003 and 2007. For complete details, see "Microsoft Security Updates for February 2009" for home users and "Microsoft Security Bulletin Summary for February 2009" for advanced users. Office also released two updates for the Outlook 2003 and 2007 Junk Email Filters.

December 2008 Update Release

The Microsoft Office Sustained Engineering Team — Wed, 03 Dec 2008 03:46:00 GMT

On Tuesday, December 9^th, 2008, Office released 18 security updates in 4 bulletins addressing a total of 15 security vulnerabilities. The security updates apply to the following products:

Microsoft Office Excel 2000, 2002, 2003, 2007, Excel Viewer 2003, Excel Viewer, and the Microsoft Office Compatibility Pack and the 2007 Microsoft Office System, as described in security bulletin MS08-074.
Microsoft Office Word 2000, 2002, 2003, 2007, Word Viewer 2003, and the Microsoft Office Compatibility Pack and the 2007 Microsoft Office System, as described in security bulletin MS08-072.
Microsoft Office XP, Project 2003, and Project 2007, as described in security bulletin MS08-070. Note: the security update for Office XP is available in the Chinese (Simplified), Chinese (Traditional), Chinese (Traditional Taiwan), and Korean locales only. Other locales of Office XP are not affected.
Microsoft Office SharePoint Server 2007 32-bit edition and 64-bit edition, as described in security bulletin MS08-077.

For complete details, see "Microsoft Security Updates for December 2008" for home users and "Microsoft Security Bulletin Summary for December 2008" for advanced users. Office also released two updates for the Outlook 2003 and 2007 Junk Email Filters.

Office also released an update to Office 2003. This update fixes a problem that prevents Office patches from installing when the Office Source Engine (OSE) service is disabled, which is one of the most common reasons for Office patches to fail to install. The Office Source Engine is used by Office to manage Office files during patch installation and is required for patch installation to succeed. After installing the update, the OSE service will run and patches will install successfully even if the service is disabled. If you are using Microsoft Update, Automatic Updates, Windows Server Update Services, or any other deployment tool that uses the Microsoft Update agent, the update will only be offered to your system if the Office Source Engine service is disabled. The update available from the Microsoft Download Center will install on all Office 2003 client systems. If you are using Windows Vista or Windows Server 2008, you may need to restart your computer after installing the update for it to take effect.

November 2008 Update Release

The Microsoft Office Sustained Engineering Team — Mon, 10 Nov 2008 22:31:00 GMT

On Tuesday, November 11^th, 2008, Office released 4 security updates in one bulletin. The security updates apply to the following products:

Microsoft Office 2003, 2007, and Microsoft Office SharePoint Server 2007 32-bit edition and 64-bit edition, as described in security bulletin MS08-069.

For complete details, see "Microsoft Security Updates for November 2008" for home users and "Microsoft Security Bulletin Summary for November 2008" for advanced users. Office also released two updates for the Outlook 2003 and 2007 Junk Email Filters.

Office also released 11 optional updates to Office Help. These updates allow you to access the latest documentation for Office when you are not connected to the internet. The updates are:

October 2008 Update Release

The Microsoft Office Sustained Engineering Team — Sat, 11 Oct 2008 02:34:00 GMT

On Tuesday, October 14^th, 2008, Office released 9 security updates across 2 bulletins. The security updates apply to the following products:

Microsoft Office Excel 2000, 2002, 2003, 2007, Excel Viewer 2003, Excel Viewer, the Microsoft Office Compatibility Pack and the 2007 Microsoft Office System, and Excel Services in Microsoft Office SharePoint Server 2007, as described in security bulletin MS08-057.
Microsoft Office XP, as described in security bulletin MS08-056.

For complete details, see "Microsoft Security Updates for October 2008" for home users and "Microsoft Security Bulletin Summary for October 2008" for advanced users. Office also released two updates for the Outlook 2003 and 2007 Junk Email Filters.

Office also released Security Update for the Access Snapshot Viewer, as described in security bulletin MS08-041. This update applies to the Download Center edition of the Access Snapshot Viewer.

Upcoming end of support for Microsoft Office 2003 Service Pack 2 (SP2)

David [Microsoft] — Mon, 22 Sep 2008 23:35:00 GMT

Office 2003 Service Pack 3 (SP3) was released nearly a year ago, on September 17th, 2007. Per the Microsoft Support Lifecycle policy for service packs, when a new Office service pack is released, the previous service pack is supported for one year. This provides customers an opportunity to test and deploy the new service pack. In accordance with Microsoft’s lifecycle policy, Office 2003 Service Pack 2 will leave support on September 17th, 2008. This date is extended for security updates to include the second Tuesday of the following month. Any security updates released on or before the second Tuesday in October, October 14th, will support both Service Packs 2 and 3. Security updates released after October 14th will support only Service Pack 3. We encourage all customers to deploy Service Pack 3 as soon as possible to take advantage of the significant security benefits that it contains.

September 2008 Update Release

David [Microsoft] — Thu, 04 Sep 2008 22:42:00 GMT

On Tuesday, September 9^th, 2008, Office released 8 security updates across 2 bulletins. The security updates apply to the following products:

Microsoft Office XP, 2003, 2007, and Microsoft Office OneNote 2007, as described in security bulletin MS08-055.
Microsoft Office XP, 2003, 2007, and Visio 2002, as described in security bulletin MS08-052.

For complete details, see “Microsoft Security Updates for September 2008” for home users and “Microsoft Security Bulletin Summary for September 2008” for advanced users. Office also released two updates for the Outlook 2003 and 2007 Junk Email Filters.

Note for Office XP users: a single update, Security Update for Microsoft Office XP (KB953405), resolves the vulnerabilities described by both MS08-052 and MS08-055 for Office XP. Users with Office XP installed should install this security update but will only need to install it once. For other versions of Office, two updates are available and both should be installed.

August 2008 Update Release

David [Microsoft] — Tue, 12 Aug 2008 20:23:00 GMT

On Tuesday, August 12^th, 2008, Office released 23 security updates across 5 bulletins. The security updates apply to the following products:

· Microsoft Office Word 2002 and 2003, as described in security bulletin MS08-042.

· Microsoft Office Excel 2000, 2002, 2003, 2007, Excel Viewer 2003, Excel Viewer, the 2007 Microsoft Office System and the Microsoft Office Compatibility Pack, and Excel Services in Microsoft Office SharePoint Server 2007, as described in security bulletin MS08-043.

· Microsoft Office PowerPoint 2000, 2002, 2003, 2007, PowerPoint Viewer 2003, and the 2007 Microsoft Office System and the Microsoft Office Compatibility Pack, as described in security bulletin MS08-051.

· Microsoft Office Access SnapShot Viewer 2000, 2002, and 2003, as described in security bulletin MS08-041.

· Microsoft Office 2000, XP, 2003 and the Microsoft Office Converter Pack, as described in security bulletin MS08-044.

For complete details, see “Microsoft Security Updates for August 2008” for home users and “Microsoft Security Bulletin Summary for August 2008” for advanced users. Office also released two updates for the Outlook 2003 and 2007 Junk Email Filters.

This month’s Word and Access security updates address vulnerabilities that had been used in attacks, as described in the Microsoft Security Advisories 953635 (Word) and 955179 (Access). The Access update modifies the class identifier of the SnapShot viewer ActiveX control and prevents opening the older, vulnerable version of the control in Internet Explorer and Office, so if you are using this control in a custom solution, please verify that your solution works properly after the update is installed.

May 2008 Update Release

David [Microsoft] — Thu, 15 May 2008 22:42:00 GMT

On Tuesday, May 13th, 2008, Office released 10 security updates across 2 bulletins. The security updates apply to Microsoft Office Word 2000, 2002, 2003, 2007, Word Viewer, the 2007 Microsoft Office System and the Microsoft Office Compatibility Pack, and Publisher 2000, 2002, 2003, and 2007. For complete details, see “Microsoft Security Updates for May 2008” for home users and “Microsoft Security Bulletin Summary for May 2008” for advanced users.

In addition to addressing several new vulnerabilities, the Word update also adds additional security mitigations against public attacks using Microsoft Word to exploit vulnerabilities in Microsoft Jet Database Engine first described in Microsoft Security Advisory 950627. We have added logic enhancements to the way Word processes documents containing database connections. After applying this update, Word will prompt a user for confirmation before running SQL commands or queries when opening Word documents. In addition to installing this update, we highly recommend that customers install the update provided in Microsoft Security Bulletin MS08-028: Vulnerabilities in Microsoft Jet Database Engine Could Allow Remote Code Execution (950749) for the most up-to-date protection against these types of attacks.