Description of the security update for Outlook 2007: June 13, 2017

Issue 1

When you open an attachment in an email, contact, or task formatted as Rich Text you get the following error:

"The program used to create this object is Outlook. That program is either not installed on your computer or it is not responding. To edit this object, install Outlook or ensure that any dialog boxes in Outlook are closed".

You may also see:

"This item contains attachments that are potentially unsafe. You may not be able to view these attachments after you close them".

See You receive an error when opening attachments in Outlook for more information.

Issue 2

When you open an attachment that includes consecutive dots (...), or an exclamation point (!), the files are blocked and you receive a warning message. See You receive an error when opening attachments in Outlook for more information.

Issue 3

If an email message includes an attached email message, and the attached email message's subject line ends with an unsafe file name extension as listed in the Blocked attachments in Outlook page, the email attachment will be blocked for recipients. To work around this issue, the sender can rename the attachment so that it does not end with an unsafe file name extension. Then, attach it to the email message to be sent.

Issue 4

When you use a custom form that you have created for Outlook, you see the following two symptoms:

• VBScript does not run.

• You get a malicious code warning

See You receive an error when opening attachments in Outlook for more information.

Issue 5

iCloud fails to load properly in Outlook 2007. When accessing Calendar, Contacts, or Tasks in Outlook 2007, you receive the following error:

Status

The loading of unregistered MAPI services has been disabled by default to make Outlook more secure.

Workaround

Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. Microsoft does not recommend this workaround but is providing this information so that you can choose to implement this workaround at your own discretion. Use this workaround at your own risk.

If you have trusted applications that depend on being loaded in this manner, you can re-enable those applications by setting the following registry key:

REG_DWORD HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

You can use the following registry subkey to apply the registry setting as a domain policy:

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

Value 0 (default): Block loading of unregistered MAPI services. This is the recommended setting to avoid unexpected execution of unknown code

Value 1: Enable loading of unregistered MAPI services.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

To make these registry changes, follow these steps:

1. Click Start, click Run, type regedit in the Open box, and then click OK.

2. Locate and then click the following subkey in the registry:

   HKCU\Software\Microsoft\Office\12.0\Outlook\Security\

3. On the Edit menu, point to New, and then click DWORD Value.

4. Type AllowUnregisteredMapiServices for the name of the DWORD, and then press Enter.

5. Right-click AllowUnregisteredMapiServices, and then click Modify.

6. In the Value data box, type 1 to enable the registry entry, and then click OK.
   Note To disable the AllowUnregisteredMapiServices setting, type 0 (zero), and then click OK.

7. Exit Registry Editor, and then restart the computer.

Vulnerability information (applies to all versions)

MAPI does not validate that a provider’s DLL that it is requested to load is registered correctly in MapiSVC.inf or even that it comes from the local machine. This can be exploited by creating a file together with an OLE object in such a way to cause MAPI to load a DLL from a network share when the OLE object is activated. This can allow arbitrary code execution to occur.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Method 1: Microsoft Update

Method 2: Microsoft Update Catalog

Method 3: Microsoft Download Center

Security update deployment information

For deployment information about this update, see security update deployment information: June 13, 2017.

Security update replacement information

This security update does not replace any previously released update.

File hash information

File information