Description of the security update for Outlook 2007: June 13, 2017

Summary

This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2017-8506, Microsoft Common Vulnerabilities and Exposures CVE-2017-8507, and Microsoft Common Vulnerabilities and Exposures CVE-2017-8508.

Note To apply this security update, you must have the release version of Service Pack 3 for the 2007 Microsoft Office suite installed on the computer.

Important This article contains information that shows you how to help to lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, Microsoft recommends that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you choose to implement this workaround, take any appropriate additional steps to help to protect your system

Known issues in this security update

Issue 1

When you open an attachment in an email, contact, or task formatted as Rich Text you get the following error:

"The program used to create this object is Outlook. That program is either not installed on your computer or it is not responding. To edit this object, install Outlook or ensure that any dialog boxes in Outlook are closed".

You may also see:

"This item contains attachments that are potentially unsafe. You may not be able to view these attachments after you close them".

See You receive an error when opening attachments in Outlook for more information.

Issue 2

When you open an attachment that includes consecutive dots (...), or an exclamation point (!), the files are blocked and you receive a warning message. See You receive an error when opening attachments in Outlook for more information.

Issue 3

If an email message includes an attached email message, and the attached email message's subject line ends with an unsafe file name extension as listed in the Blocked attachments in Outlook page, the email attachment will be blocked for recipients. To work around this issue, the sender can rename the attachment so that it does not end with an unsafe file name extension. Then, attach it to the email message to be sent.

Issue 4

When you use a custom form that you have created for Outlook, you see the following two symptoms:

  • VBScript does not run.

  • You get a malicious code warning

See You receive an error when opening attachments in Outlook for more information.

Issue 5

iCloud fails to load properly in Outlook 2007. When accessing Calendar, Contacts, or Tasks in Outlook 2007, you receive the following error:

The set of folders cannot be opened.
MAPI was unable to load the information service C:\PROGRA~2\COMMON~1\Apple\Internet Services\APLZOD.dll. Be sure the service is correctly installed and configured.


Status

The loading of unregistered MAPI services has been disabled by default to make Outlook more secure.


Workaround

Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. Microsoft does not recommend this workaround but is providing this information so that you can choose to implement this workaround at your own discretion. Use this workaround at your own risk.

If you have trusted applications that depend on being loaded in this manner, you can re-enable those applications by setting the following registry key:

REG_DWORD HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

You can use the following registry subkey to apply the registry setting as a domain policy:

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

 

Value 0 (default): Block loading of unregistered MAPI services. This is the recommended setting to avoid unexpected execution of unknown code

Value 1: Enable loading of unregistered MAPI services.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

To make these registry changes, follow these steps:

  1. Click Start, click Run, type regedit in the Open box, and then click OK.

  2. Locate and then click the following subkey in the registry:

    HKCU\Software\Microsoft\Office\12.0\Outlook\Security\

  3. On the Edit menu, point to New, and then click DWORD Value.

  4. Type AllowUnregisteredMapiServices for the name of the DWORD, and then press Enter.

  5. Right-click AllowUnregisteredMapiServices, and then click Modify.

  6. In the Value data box, type 1 to enable the registry entry, and then click OK.
    Note To disable the AllowUnregisteredMapiServices setting, type 0 (zero), and then click OK.

  7. Exit Registry Editor, and then restart the computer.


Vulnerability information (applies to all versions)

MAPI does not validate that a provider’s DLL that it is requested to load is registered correctly in MapiSVC.inf or even that it comes from the local machine. This can be exploited by creating a file together with an OLE object in such a way to cause MAPI to load a DLL from a network share when the OLE object is activated. This can allow arbitrary code execution to occur.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

More Information

Security update deployment information

For deployment information about this update, see security update deployment information: June 13, 2017.

Security update replacement information

This security update does not replace any previously released update.

File hash information

Package Name

Package Hash SHA 1

Package Hash SHA 2

outlook2007-kb3191898-fullfile-x86-glb.exe

ACAA487F89E2995DEBE4BADCB84A748AC0965595

759D681EB22F7B20695D97D12DD0D939B8A744489766719A5B630F1C12F8D6FC

File information

The English version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight-saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.


For all supported x86-based versions of Outlook 2007

File identifier

File name

File version

File size

Date

Time

Contab32.dll

Contab32.dll

12.0.6650.5000

128,376

30-Aug-2011

17:46

Dlgsetp.dll

Dlgsetp.dll

12.0.6658.5000

88,368

07-Feb-2012

22:47

Dumpster.dll

Dumpster.dll

12.0.6650.5000

34,208

30-Aug-2011

17:46

Envelope.dll

Envelope.dll

12.0.6652.5000

154,000

21-Sep-2011

13:43

Impmail.dll

Impmail.dll

12.0.6658.5000

138,536

07-Feb-2012

22:47

Mimedir.dll

Mimedir.dll

12.0.6658.5000

340,760

07-Feb-2012

22:47

Olkfstub.dll

Olkfstub.dll

12.0.6650.5000

253,824

30-Aug-2011

17:46

Olmapi32.dll

Olmapi32.dll

12.0.6770.5000

3,095,808

03-Jun-2017

15:32

Omsmain.dll

Omsmain.dll

12.0.6713.5000

662,728

18-Nov-2014

08:00

Omsxp32.dll

Omsxp32.dll

12.0.6713.5000

195,288

18-Nov-2014

08:00

Outlmime.dll

Outlmime.dll

12.0.6755.5000

600,368

16-Aug-2016

18:03

Outlook.exe

Outlook.exe

12.0.6770.5000

12,967,656

03-Jun-2017

15:32

Outlph.dll

Outlph.dll

12.0.6670.5000

177,272

07-Nov-2012

15:02

Outlvba.dll

Outlvba.dll

12.0.6713.5000

52,920

18-Nov-2014

07:53

Pstprx32.dll

Pstprx32.dll

12.0.6658.5000

422,184

07-Feb-2012

22:47

Recall.dll

Recall.dll

12.0.6658.5000

38,696

07-Feb-2012

22:47

Rm.dll

Rm.dll

12.0.6650.5000

75,624

30-Aug-2011

17:46

Rtfhtml.dll

Rtfhtml.dll

12.0.6658.5000

411,440

09-Feb-2012

04:30

Scanost.exe

Scanost.exe

12.0.6650.5000

54,104

30-Aug-2011

17:46

Scnpst32.dll

Scnpst32.dll

12.0.6650.5000

273,832

30-Aug-2011

17:46

Scnpst64.dll

Scnpst64.dll

12.0.6650.5000

282,032

30-Aug-2011

17:46

How to get help and support for this security update

Help for installing updates: Windows Update FAQ

Security solutions for IT professionals: TechNet Security Support and Troubleshooting

Help for protecting your Windows-based computer from viruses and malware: Microsoft Secure

Local support according to your country: International Support

Propose a feature or provide feedback on Office Core: Office User Voice portal

 

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×