Microsoft today released its March 2008 security bulletin, which includes four bulletins, all deemed critical by Microsoft.
The most serious of these affects Microsoft Excel, which alone has six specific "Common Vulnerablities and Exposures" vulnerabilities noted, one of which has been exploited in the wild. The next most serious affects Microsoft Outlook. In that one, a vulnerability in how the software parses "mailto" URIs could lead to remote code execution. A third bulletin affects how various Microsoft Office apps open maliciously crafted files. The final bulletin concerns how Office interfaces with the Web and includes one vulnerability that has been known but unpatched since September 2006. All Microsoft security patches for both Windows and Office software are available via Microsoft Update or via the individual bulletins detailed below.
Entitled "Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (949029)," this bulletin is critical for users of Microsoft Excel 2000 Service Pack 3, and important for users of Excel 2002 Service Pack 3, Excel 2003 Service Pack 2, Excel 2007, Microsoft Office Excel Viewer 2003, Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats, Microsoft Office 2004 for Mac, and Microsoft Office 2008 for Mac. Not affected are Microsoft Works 8, 8.5, and 9, or Works suite 2005 and Works suite 2006. The update addresses vulnerabilities detailed in CVE-2008-0111, CVE-2008-0112, CVE-2008-0114, CVE-2008-0115, CVE-2008-0116, CVE-2008-0117, and CVE-2008-0081. Microsoft says, "an attacker who successfully exploited these vulnerabilities could take complete control of an affected system and could then install programs; view, change, or delete data; or create new accounts with full user rights."
Entitled "Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (949031)," this bulletin affects users of Microsoft Outlook 2000 Service Pack 3, Outlook 2002 Service Pack 3, Outlook 2003 Service Pack 2, Outlook 2003 Service Pack 3, and Outlook 2007. Not affected are users of Outlook 2007 Service Pack 1. The update addresses the vulnerability detailed in CVE-2008-0110. Microsoft says this vulnerability "could allow remote code execution if Outlook is passed a specially crafted mailto URI. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This vulnerability is not exploitable by simply viewing an e-mail through the Outlook preview pane."
Entitled "Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (949030)," this bulletin affects users of Microsoft Office 2000 Service Pack 3, Microsoft Office XP Service Pack 3, Microsoft Office 2003 Service Pack 2, Microsoft Office Excel Viewer 2003, Microsoft Office Excel Viewer 2003 Service Pack 3, and Microsoft Office 2004 for Mac. Not affected are users of Microsoft Office 2003 Service Pack 3, Microsoft PowerPoint Viewer 2003, Microsoft Visio 2002 Service Pack 2, Microsoft Visio 2003 Viewer, Microsoft Word Viewer 2003, Microsoft Project 2000 Service Pack 1, Microsoft Project 2002 Service Pack 2, 2007 Microsoft Office System, 2007 Microsoft Office System Service Pack 1, and Microsoft Office 2008 for Mac. The update addresses the vulnerability detailed in CVE-2008-0113 and CVE-2008-0118. Microsoft says, "an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights."
Entitled "Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution (933103)," this bulletin affects users of Microsoft Office 2000 Service Pack 3, Microsoft Office XP Service Pack 3, Visual Studio .NET 2002 Service Pack 1, Visual Studio .NET 2003 Service Pack 1, Microsoft BizTalk Server 2000, Microsoft BizTalk Server 2002, Microsoft Commerce Server 2000, and Internet Security and Acceleration Server 2000 Service Pack 2. Not affected are users of Microsoft Works 8, Microsoft Works 9, Microsoft Works Suite 2005, Microsoft Works Suite 2006, Microsoft Office 2003 Service Pack 2, Microsoft Office 2003 Service Pack 3, 2007 Microsoft Office System, 2007 Microsoft Office System Service Pack 1, Microsoft BizTalk Server 2004, Microsoft BizTalk Server 2006, Microsoft Commerce Server 2000 Service Pack 1, Microsoft Commerce Server 2000 Service Pack 2, and Microsoft Commerce Server 2000 Service Pack 3, Microsoft Commerce Server 2002, Microsoft Commerce Server 2007, Internet Security and Acceleration Server 2004, and Internet Security and Acceleration Server 2006. This update addresses the vulnerability detailed in CVE-2006-4695 and CVE-2007-1201. Microsoft says, "these vulnerabilities could allow remote code execution if a user viewed a specially crafted Web page. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights."
I installed the new version of Microsoft Office for Mac on Saturday and spent a bit of time with it on my flight to Boston on Sunday. (Check out the official CNET review here.) While I like the cleaner interface and some of the new fonts, overall I feel like the applications are much slower. I also found out the hard way that the default save state of .docx screws you pretty much immediately if you aren't careful. (To Microsoft's credit, you can easily change this in the preferences.)
I mainly used Word as I was afraid that Excel would jack me up. One positive for Word is that creating themes for documents has become much easier. One negative is that my documents would occasionally disappear between Expose windows and show up in the "window" menu but not on screen. Having spent a fair amount of time on a doc, I was pretty shocked when it all of the sudden disappeared.
The big thing to note is that the Mac version of Word and Powerpoint are significantly more user-friendly than the new Office for Windows. And while we all expect Mac software to be easier to use, it doesn't make a lot of sense that Microsoft wouldn't have applied the cleaner interface to the Windows product.
I bought Microsoft's newest version of Office for Mac (2008) on Tuesday and have been using it nonstop ever since. (Check out the CNET review here.) It is snappy, intuitive, and even innovative in some ways. (MyDay, seen at right, is a blessing.) In short, Microsoft has done something very, very right with this product. I recommend it to everyone who needs it.
Entourage is the biggest area where I see improvements. It is soooo fast compared with Office 2004 for Mac. The UI is gorgeous. My favorite improvement, however, is My Day. It's a floating window that shows my upcoming appointments, "To Do" items, and e-mails that I've flagged for action. It's such a simple addition, but I'm already wholly reliant on it.
The product does have some downsides.
... Read MoreCorrection 2:10 p.m. PDT: This blog initially misstated the savings for buyers of Office 2004 for Mac Student and Teacher edition if they choose to upgrade to the 2008 Special Media Edition. The savings would be $350.
Microsoft has improved on an earlier offer to those who buy Office 2004 for Mac before the new version of Office is released in January.
In September, the company said it would offer buyers of Office 2004 an upgrade to the comparable version of Office 2008 for the cost of shipping and handling.
Now, those who purchase Office 2004 for Mac Student and Teacher edition ($149), the Standard version ($399), or the Standard upgrade ($239) are eligible to receive the new Office 2008 for Mac Special Media Edition for $6.99, the cost of shipping and handling. The Special Media Edition will retail for $499.
The Standard flavor includes a single license, while three licenses are included with the less expensive Student and Teacher edition. Microsoft does not verify whether those who buy this education edition really attend or work at a school or university. However, consumers must pledge in the End User License Agreement that they bought the edition for use in a school.
The Special Media Edition includes Word, Excel, PowerPoint, and Expression Media, an image file management application.
The discount offer lasts until January 14. Office 2008 for Mac is set to ship the next day. Customers' licenses from the 2004 and 2008 versions will remain valid.
The potential savings would be $350 for buying Office 2004 for Mac Student and Teacher and receiving the 2008 Special Media Edition for free.
Office 2008 for Mac is also available in other flavors. For $399, the Standard edition swaps Expression Media for the Entourage scheduling application. Office 2008 for Mac Home and Student, equivalent to 2004 Student and Teacher, includes Word, Excel, and PowerPoint for $149.
Microsoft provided an early look at the Office 2008 for Mac 11 months ago, and has been gradually rolling out details about other new features, such as a bigger selection of templates and enhanced Exchange support, and the capability to configure out-of-office settings in Exchange. No public beta tests have been made available.
At full price, Office 2008 for Mac costs at least twice as much as its competitors. Other Mac productivity software options include the $79 Apple iWork, the free OpenOffice, and the $49 ThinkFree desktop and online bundle. Additional free competitors to Office include browser-based suites such as Google Docs & Spreadsheets and Zoho Office. All options offer a word processor, and presentations and spreadsheet programs that can read Microsoft Office documents.
Microsoft is revealing more details about new features in its Office for Mac 2008 suite, due for a release early next year.
Excel 2008 for Mac will offer worksheet templates with baked-in calculations designed to make it easier to balance household finances, manage inventory and other common tasks. The new Ledger Sheets features will include a gallery of elements, shifting formulas to the background.
In addition, the Entourage e-mail client will offer more support for Microsoft Exchange, which traditionally has enabled non-Mac PC users to make appointments and share notes and files with each other.
Each version of Office for Mac will cost about a dollar more than the 2004 editions. The $149 package will lack Exchange capabilities, while $399 buys the works: Word, Excel, PowerPoint and Exchange-ready Entourage.
Mac users must wait until next year for fresh versions of Word, Excel and PowerPoint: Microsoft has moved its intended launch of Office for Mac 2008 to January from the second half of this year.
"We had hoped to hit the Christmas selling season, but now we hope to target Macworld" in January, said Craig Eisler, who became general manager of the Mac business unit at Microsoft six weeks ago. "We, as a group, were not satisfied with product quality."
Details about any software development snags, as well as final pricing, were unavailable. Office for Mac 2004 is sold in three versions for $150 to $500.
The company demonstrated early previews of Office for Mac 2008 at the Macworld 2007 convention in January.
Microsoft will not open beta testing to the public as it did for more than six months while building Office 2007 for Windows.
The 2008 release will be the first built for Intel-based Macs. The features and visual style of Office for Mac software differ from their Windows counterparts. Microsoft is introducing XML-based file formats, which require a converter to be opened in older Office software. A time-management, task-launching widget joins Office for Mac 2008 in addition to Word, Excel, PowerPoint and the Entourage e-mail application.
Among the controversial anticipated changes is the removal of Visual Basic scripting, which enables macros that automate commonly used software functions.
Microsoft also postponed its initial shipment deadlines for Windows Vista and Office 2007, which arrived in stores on January 30 amid a marketing blitz following the holiday shopping season.
Microsoft aims to unveil its next operating system, internally code named "Windows 7," within three years.
Meanwhile, Apple remains mum about the timing and features of its next iWork office suite, a competitor to Microsoft Office. The MacRumors blog speculates that Apple may skip a 2007 version, instead releasing iWork '08 in October in tandem with the Leopard Mac OS X operating system.
Further competition to Microsoft Office and iWork looms in the form of free, Web-based productivity software, such as Google Docs & Spreadsheets.
One more time around the block, James.
Microsoft late Thursday revised one of its critical security bulletins from Patch Tuesday, adding another item to its list of affected software.
Security bulletin MS07-036 now includes a warning that Microsoft Office 2004 for the Mac is also affected.
The update is designed to address a security flaw, which could allow attackers to overwrite the computer's memory with malicious code.
Microsoft notes that people running Office 2004 for the Mac on the Mac OS X 10.2 are at risk. It advises people to first install the Microsoft Office 2004 for Mac 11.3.5 update, before downloading the latest fix.
- prev
- 1
- next
