Description of the security update for Outlook 2007: June 13, 2017

Applies to: Microsoft Office Outlook 2007

Summary


This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2017-8506, Microsoft Common Vulnerabilities and Exposures CVE-2017-8507, and Microsoft Common Vulnerabilities and Exposures CVE-2017-8508.

Note To apply this security update, you must have the release version of Service Pack 3 for the 2007 Microsoft Office suite installed on the computer.

Important This article contains information that shows you how to help to lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, Microsoft recommends that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you choose to implement this workaround, take any appropriate additional steps to help to protect your system

Known issues in this security update


Issue 1

When you open an attachment in an email, contact, or task formatted as Rich Text you get the following error:

"The program used to create this object is Outlook. That program is either not installed on your computer or it is not responding. To edit this object, install Outlook or ensure that any dialog boxes in Outlook are closed".

Issue 2

When you open an attachment that includes consecutive dots (...), or an exclamation point (!), the files are blocked and you receive a warning message. See You receive an error when opening attachments in Outlook for more information.

Issue 3

If an email message includes an attached email message, and the attached email message's subject line ends with an unsafe file name extension as listed in the Blocked attachments in Outlook page, the email attachment will be blocked for recipients. To work around this issue, the sender can rename the attachment so that it does not end with an unsafe file name extension. Then, attach it to the email message to be sent.

Issue 4

Issue 5

iCloud fails to load properly in Outlook 2007. When accessing Calendar, Contacts, or Tasks in Outlook 2007, you receive the following error:

The set of folders cannot be opened.
MAPI was unable to load the information service C:\PROGRA~2\COMMON~1\Apple\Internet Services\APLZOD.dll. Be sure the service is correctly installed and configured.


Status

The loading of unregistered MAPI services has been disabled by default to make Outlook more secure.


Workaround

Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. Microsoft does not recommend this workaround but is providing this information so that you can choose to implement this workaround at your own discretion. Use this workaround at your own risk.

If you have trusted applications that depend on being loaded in this manner, you can re-enable those applications by setting the following registry key:

REG_DWORD HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

You can use the following registry subkey to apply the registry setting as a domain policy:

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

 

Value 0 (default): Block loading of unregistered MAPI services. This is the recommended setting to avoid unexpected execution of unknown code

Value 1: Enable loading of unregistered MAPI services.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows
 

To make these registry changes, follow these steps:

  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate and then click the following subkey in the registry:
    HKCU\Software\Microsoft\Office\12.0\Outlook\Security\
  3. On the Edit menu, point to New, and then click DWORD Value.
  4. Type AllowUnregisteredMapiServices for the name of the DWORD, and then press Enter.
  5. Right-click AllowUnregisteredMapiServices, and then click Modify.
  6. In the Value data box, type 1 to enable the registry entry, and then click OK.
    Note To disable the AllowUnregisteredMapiServices setting, type 0 (zero), and then click OK.
  7. Exit Registry Editor, and then restart the computer.


Vulnerability information (applies to all versions)

MAPI does not validate that a provider’s DLL that it is requested to load is registered correctly in MapiSVC.inf or even that it comes from the local machine. This can be exploited by creating a file together with an OLE object in such a way to cause MAPI to load a DLL from a network share when the OLE object is activated. This can allow arbitrary code execution to occur.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

How to get and install the update


Method 1: Microsoft Update

Method 2: Microsoft Update Catalog

Method 3: Microsoft Download Center

More Information


Security update deployment information

For deployment information about this update, see security update deployment information: June 13, 2017.

Security update replacement information

This security update does not replace any previously released update.

File hash information

Package Name Package Hash SHA 1 Package Hash SHA 2
outlook2007-kb3191898-fullfile-x86-glb.exe ACAA487F89E2995DEBE4BADCB84A748AC0965595 759D681EB22F7B20695D97D12DD0D939B8A744489766719A5B630F1C12F8D6FC

File information

How to get help and support for this security update


Help for installing updates: Windows Update FAQ

Security solutions for IT professionals:
TechNet Security Support and Troubleshooting

Help for protecting your Windows-based computer from viruses and malware:
Microsoft Secure

Local support according to your country:
International Support

Propose a feature or provide feedback on Office Core: Office User Voice portal