Downloadable White Paper
[pic]
Microsoft Office 2003 Service Pack 3
White Paper
Published: September 2007
For the latest information, please see .
Abstract
Microsoft® Office 2003 Service Pack 3 (SP3) adds important security enhancements, resolves customer requests, and eases compatibility with the Windows Vista® operating system and the 2007 Microsoft Office system. This white paper discusses the benefits of deploying Office 2003 SP3 before upgrading to the 2007 release and details improvements to security and user experience.
[pic]
Contents
Introduction 1
Business Considerations 2
Increased Security 2
Increased Productivity 3
Minor Impact on Existing Systems 3
User Experience Improvements 5
Compatibility with Windows Vista 5
Stability and Usability 5
Access 2003 5
Excel 2003 6
OneNote 2003 6
Outlook 2003 6
PowerPoint 2003 6
Project 2003 7
Word 2003 7
Security Improvements 8
Microsoft Office Isolated Conversion Environment and File Block 8
COM Add-Ins and ActiveX Controls 8
Access 2003 9
Excel 2003 9
Outlook 2003 9
Visio 2003 9
Word 2003 9
Conclusion 10
Resources 11
Appendix of KB Articles 12
Introduction
Microsoft® Office 2003 Service Pack 3 (SP3) is the culmination of several years of improvements to the product suite. In addition to bringing together previously released updates into one package, Office 2003 SP3 also addresses a range of user experience issues.
For employees and home users, Office 2003 SP3 improves the performance and simplifies the use of applications they rely upon most. Office 2003 SP3 makes it easier to work with the Windows Vista® operating system, exchange files with people who use the 2007 Microsoft Office system, and interact with servers in the 2007 release. And by addressing more customer requests, Office 2003 SP3 minimizes issues that previously caused distractions.
For businesses, Office 2003 SP3 is a crucial update that addresses security issues surrounding legacy file formats and add-ins using the Microsoft component object model (COM) and privacy concerns regarding hidden metadata. The service pack also provides IT administrators with more tools to protect the company’s IT and intellectual assets. It strengthens security by closing off frequently exploited methods of attack, incorporating security enhancements developed as part of the 2007 release, and giving IT administrators greater control over user behavior.
Business Considerations
Although home and office users will benefit from installing Microsoft® Office 2003 Service Pack 3 (SP3) as soon as possible, many businesses may hesitate because of the concerns regarding deployment and compatibility with existing systems and applications. This section addresses major business considerations and provides positive reasons for immediate deployment.
Increased Security
Companies that have not yet upgraded to the 2007 Microsoft Office system can still benefit from many of the major security improvements in that version by deploying Office 2003 SP3, which incorporates many security enhancements included in the 2007 release. These improvements make Office 2003 SP3 an essential upgrade, especially to mitigate current and emerging security concerns.
Office 2003 SP3 helps businesses defend themselves against external threats, such as malicious software infections, by closing off avenues of attack:
• Office 2003 SP3 now automatically tests add-ins using the Microsoft component object model (COM) and ActiveX® controls and blocks a subset of insecure components.
• Office 2003 SP3 provides IT administrators with more powerful policy controls regarding COM objects.
• Microsoft Office Excel® 2003 now allows users to determine which macros written in Microsoft Visual Basic® for Applications they will allow to run in Microsoft Excel 5.0/95 Workbook format-based files.
• Microsoft Office Outlook® 2003 now automatically blocks .gadget files, which contain executable code.
Office 2003 SP3 also empowers companies to comply with government regulations and stem leaks of confidential information, whether inadvertent or intentional. In April 2007, Forrester Research reported that companies paid between U.S.$90 and U.S.$305 for each record that was leaked, stolen, or lost.[1] Together, with strong policies and user education, Office 2003 SP3 helps companies prevent embarrassing and costly data security breaches. For example, Microsoft Office Word 2003 no longer uses the Fast Save feature, which might retain confidential information that could be extracted after a document is sent outside the company.
Protection from Social Engineering Attacks
Office 2003 SP3 includes greater protection from attacks that use “social engineering” techniques to spread malicious software and steal important corporate information. Social engineering attacks are a growing threat to companies. The Microsoft Windows Malicious Software Removal Tool (MSRT), freely distributed to at least 270 million unique computers since its release in 2005, provides Microsoft with insight into how malicious software is spread. Using data from MSRT, the Microsoft Antimalware Team reported in November 2006 that 35 percent of all machine infections resulted from social engineering attacks.[2]
Stymied by filters and firewalls that block automated attacks, hackers are shifting their focus to the applications, especially common desktop software. These attacks depend largely on social engineering—convincing a user inside the network to unwittingly install malicious software or otherwise take actions that compromise security. Recognizing this trend, Microsoft focused on making applications in the 2007 Microsoft Office system more resilient against social engineering attacks. This was accomplished by building more automated safeguards into the product while also simplifying user-driven security decisions.
After evaluating the success of these improvements, it was clear that many could increase protection in the 2003 Office release as well. Office 2003 SP3 is the vehicle for delivering this increased protection. One of the enhanced security measures provided with Office 2003 SP3 is the Microsoft Office Isolated Conversion Environment (MOICE). This tool automatically runs documents through a conversion and scrubbing process to remove malicious content, helping to protect users against malicious code concealed within rigged documents. Office 2003 SP3 also gives IT administrators methods of controlling what types of files users can download and open. Having more control allows IT administrators to quickly adjust what file types and behaviors are permitted in response to constantly evolving attacks.
Increased Productivity
Office 2003 SP3 also offers significant improvements to the user experience, which translate into increased productivity, especially for companies that are transitioning to the Windows Vista® operating system and the 2007 Microsoft Office system. For instance, Office 2003 SP3 makes it easier for employees to view and work with newer files created by their co-workers and business contacts using Microsoft Office programs. Improvements in compatibility with Windows Vista and the 2007 release include:
• When running in Windows Vista, Microsoft Office OneNote® 2003 now reports the correct hyperlink address when clipping from a multiple-tab browser session on Windows® Internet Explorer® 7.
• Microsoft Office Project 2003 reads files created in Office Project 2007.
In addition to smoothing compatibility issues, Office 2003 SP3 also improves productivity by resolving minor distractions, such as:
• Microsoft Office Access 2003 no longer causes the computer screen to flicker when users move the mouse cursor over pages of a tab control.
• Microsoft Office PowerPoint 2003 now allows users to update a linked Object Linking and Embedding (OLE) object, such as a linked external picture, without error.
• Excel 2003 now displays security warnings when opening a large spreadsheet with macros over a slow network share, allowing users to decide whether to run macros or not.
• Word 2003 users can copy and paste text from a Web e-mail account—such as Windows Live™ Hotmail®, or Yahoo! Mail—in Internet Explorer 7, without causing Word 2003 to crash.
Minor Impact on Existing Systems
Perhaps of most concern to some companies is how Office 2003 SP3 will impact their existing systems, especially those that use custom tie-ins to Microsoft Office programs. Microsoft has rigorously tested Office 2003 SP3 with major business software packages, including third-party products from Hyperion and SAP, and identified no major compatibility issues. However, as a best practice, organizations should conduct compatibility tests with critical systems and solutions before deploying Office 2003 SP3 across the organization.
Other changes to the 2003 Office release that might adversely affect systems and workflows are referenced here in this white paper and documented more thoroughly in referenced Microsoft Knowledge Base (KB) articles. The most noticeable of these changes:
• The functionality of COM add-ins and ActiveX controls may be reduced or blocked if the component uses insecure interface methods. Office 2003 SP3 automatically tests all COM components and limits potentially insecure functions. Although most components will pass this automatic test, Microsoft provides guidance on how IT administrators can update their COM add-ins and ActiveX controls to comply.
• Legacy file formats created using Microsoft Office programs are disabled by default. This increases security because hackers can more easily find vulnerabilities in the older formats. IT administrators can change the settings to allow specific document formats, if needed.
User Experience Improvements
Microsoft® Office 2003 Service Pack 3 (SP3) resolves a range of issues discovered through Microsoft Online Crash Analysis and Microsoft Product Support feedback. In all, Office 2003 SP3 addresses more than 450 issues, resulting in the most stable and user-friendly update to the 2003 Office release. This section provides summaries of the most noticeable improvements to the user experience, along with references to appropriate Microsoft Knowledge Base (KB) articles.
Compatibility with Windows Vista
Employees using the Windows Vista® operating system and exchanging files with colleagues who use the 2007 Microsoft Office system will appreciate improved compatibility with those products, including:
• Microsoft Office InfoPath® 2003 now allows the auto-complete function with Windows® Internet Explorer® 7 when using a computer running Windows Vista. For more information, please read KB Article 938792.
• Microsoft Office Visio® 2003 now prompts people using Windows Vista–based computers to save changes to a diagram when exiting the program. For more information, read KB Article 938794.
• Users can now install Microsoft Office Access™ add-ins on Windows Vista. For more information, read KB Article 938809.
Stability and Usability
• Office 2003 SP3 displays presence information of work associates regardless of their instant messaging provider. Previously, programs in the 2003 Office release only displayed the presence of people whose instant messaging provider matched that of the logged-in user. For more information, read KB Article 938792.
• Office 2003 SP3 allows users to open the rich text editor of Windows SharePoint® Services 3.0 using Internet Explorer 7 without causing errors. For more information, read KB Article 938793.
• Employees can now use the 2003 Office release to create a document workspace in Microsoft Office Excel® 2003, Microsoft Office PowerPoint® 2003, or Microsoft Office Word 2003 on Windows SharePoint® Services 3.0 without getting an error message. For more information, read KB Article 938792.
Access 2003
Microsoft Office Access 2003 now facilitates collaboration between people using different versions of the program and fixes minor interface issues.
• Access 2003 now allows users to open an Access project (.adp) that was created in a different version of Access and immediately creates an Access project extension (.ade) without error. For more information, please read KB Article 938792.
• People can now use the “Save As Text” command in Access 2003 on MDB Access Database (.mdb) files that were created in Office Access 2007. For more information, read KB Article 938792.
• Moving the mouse over pages of a tab control in Access 2003 no longer causes the computer screen to flicker. For more information, read KB Article 938792.
Excel 2003
Office Excel 2003 now makes it easier for professionals to work with large workbooks containing customized macros by providing them with more control over how macros are used and files are opened.
• When opening a spreadsheet in Excel 2003 with Excel macros across a slow network share, the macro security warning is now displayed. Previously, Excel 2003 would automatically disable macros under certain circumstances. For more information, read KB Article 938790.
• When a user attempts to open a file with problems in Excel 2003, they are given a new alert asking if they want to attempt to repair that file.
• Excel 2003 presents an alert when users edit a database query.
OneNote 2003
The screen-clipping function in Microsoft Office OneNote® 2003 now reports the correct hyperlink address when clipping from a multitabbed Internet Explorer 7 browser session.
Outlook 2003
Microsoft Office Outlook® 2003 adds a policy key that IT administrators can use to control the number of nested multipurpose Internet mail extensions (MIME) allowed in incoming e-mail messages. Too many attachments in an incoming e-mail message could cause Outlook 2003 to slow considerably. Office 2003 SP3 sets the default limit at 50 nested attachments; IT administrators can adjust this limit to prevent users from receiving e-mail messages with inordinate amounts of attachments. For more information, read KB Article 938817.
PowerPoint 2003
PowerPoint 2003 now makes it easier for people to update linked objects within presentations and package those presentations to a CD.
• PowerPoint 2003 no longer presents an error message when users update an Object Linking and Embedding (OLE) object that is linked to an HTTP address that contains an item moniker. For more information, read KB Article 938801.
• PowerPoint 2003 now retains original file data when packaging presentations created in Microsoft Office PowerPoint 2007 for CDs. This allows PowerPoint 2003 users to burn a presentation created in Office PowerPoint 2007 to a CD and know that data from the original presentation will be retained when opened again in Office PowerPoint 2007. For more information, read KB Article 938801.
Project 2003
Microsoft Office Project 2003 provides valuable new functionality to project managers and other business users that use master projects and frequently exchange files from various Microsoft Office Project versions.
• Project 2003 now allows users to open Office Project 2007 files that are not password-protected. For more information, read KB Article 938804.
• Project 2003 no longer closes unexpectedly when opening a master project in which sub-projects have been expanded. For more information, read KB Article 938797.
Word 2003
Word 2003 now offers greater stability and usability when utilizing online content and templates.
• Word 2003 no longer removes macros, toolbars, and auto-text entries from documents that were created using online templates when those documents are closed and reopened. For more information, read KB Article 938799.
• Word 2003 no longer unexpectedly closes when users copy and paste text from a Web e-mail account—such as Windows Live™ Hotmail®, or Yahoo! Mail—in Internet Explorer 7. For more information, read KB Article 938799.
Security Improvements
Microsoft® Office 2003 Service Pack 3 (SP3) offers important security enhancements for both consumers and businesses. Office 2003 SP3 hardens applications against attack by providing protection against corrupted documents or tampered file formats that might contain malware. The new update also helps IT administrators enforce corporate IT policies by controlling what types of files users can open. Finally, Office 2003 SP3 helps companies prevent embarrassing data security breaches by completely erasing hidden metadata from scrubbed documents.
This section summarizes the most important security improvements included in Office 2003 SP3 and references associated Microsoft Knowledge Base (KB) articles.
Microsoft Office Isolated Conversion Environment and File Block
Office 2003 SP3 includes two important security tools that greatly reduce the threat of malware concealed within Microsoft Office documents. Released separately in Spring 2007, both tools were developed using technology in the 2007 Microsoft Office system but were developed largely to benefit Microsoft Office Excel® 2003, Microsoft Office PowerPoint® 2003, and Microsoft Office Word 2003.
Microsoft Office Isolated Conversion Environment (MOICE) allows users to open Microsoft Office documents from unknown senders with relative safety. MOICE uses the converters in the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats to convert binary format files into the newer Office Open XML format. The conversion process removes malicious content within corrupted or tampered documents and has successfully remedied all issues to date. MOICE conducts these cleansings in a restricted process, thereby protecting the underlying system in the event that any code tries to execute during the conversion process.
File Block complements MOICE by allowing IT administrators to temporarily prevent certain file formats from opening through registry or group policy. This provides companies with the flexibility needed to quickly respond to evolving threats without unduly limiting productivity.
There are some important considerations for MOICE and File Block, so please refer to these links for more information: KB Article 935865 and Microsoft Security Advisory 937696.
COM Add-Ins and ActiveX Controls
Although Microsoft component object model (COM) add-ins and ActiveX® controls in Microsoft Office documents offer rich, customized functionality, they are also a potential security risk without rigorous IT policies and tools in place. At worst, Microsoft Office documents with these components could harbor malicious code that runs automatically once the document is opened.
Office 2003 SP3 further strengthens the 2003 Microsoft Office release against these scenarios with a new automatic test for COM add-ins and ActiveX controls to ensure they are not written using a potentially insecure QueryInterface() method. This automatic test is run when programs in the 2003 Microsoft Office release are started and poses no problem for components with properly addressed interface code. For more information, read KB Article 938814.
In addition, Office 2003 SP3 allows administrators and users to set registry settings to control the behavior of COM add-ins. To read more, see KB Article 938815.
Access 2003
When employing macros that require a password, Microsoft Office Access 2003 now alerts users that the password is stored in clear text and not encrypted.
Excel 2003
Office 2003 SP3 updates the default security settings for Microsoft Visual Basic® for Applications macros in Microsoft Excel® 5.0/95 Workbook files. These files may contain an older Microsoft Excel 4.0 macro type that cannot be disabled or signed. If the workbook files contain these macros, they will not open in Excel 2003 when macro security levels are set to High or Very High; if the macro security level is set to Medium, the user will be prompted to enable or disable the macros. This change provides users with more control to determine which macros will run and protects against attacks that take advantage of weaknesses in the older file format. For more information, read KB Article 938806.
Outlook 2003
Microsoft Office Outlook® 2003 now blocks .gadget files that are sent as e-mail attachments because they contain executable code—possibly a malicious software payload. If the user needs a .gadget file from someone, they can request the file be uploaded to a file share or compressed using a file compression utility before sent through e-mail. For more information, read KB Article 938811.
Visio 2003
Microsoft Office Visio® 2003 now allows IT administrators to disable AutoCAD file format (.dwg) files to improve security. Once disabled, AutoCAD Drawing options will be removed from Open and Save As dialog boxes. Files created in Visio that contain CAD objects will not display those objects. For more information, read KB Article 938803.
Word 2003
To ensure confidential data is not inadvertently passed on in metadata, Office 2003 SP3 disables the Fast Save feature. The Allow Fast Saves check box will continue to appear in the Save Options dialog, but it will not be functional.
While the Fast Save feature speeds up the document-saving process by saving only the changes made to a document, the saved document may contain metadata, such as comments, erased text, previous versions, and authorship. Disabling Fast Save ensures that confidential data is protected against improper disclosure. For more information, read KB Article 938808.
Conclusion
Microsoft® Office 2003 Service Pack 3 (SP3) improves the productivity and user experience of home and office users, strengthens defenses against malicious software, and helps IT administrators comply with regulations and protect confidential information. Office 2003 SP3 addresses the majority of outstanding customer requests so that there are few remaining known issues. To enhance security, Office 2003 SP3 includes recent, individually released patches and incorporates new features—such as the Microsoft Office Isolated Conversion Environment (MOICE) and File Block—that were developed as part of the 2007 Microsoft Office system.
Resources
This Microsoft® Office 2003 Service Pack 3 White Paper is a general paper; see below for links to more detailed resources.
Office 2003 Resource Kit
This resource includes detailed information that is useful for IT administrators, such as: general information about the security environment, locked-down configurations, code development and built-in security settings, and security-related policies for the 2003 Microsoft Office release. To read more, please visit:
Office System TechCenter: Microsoft Office 2003
The entire 2003 Microsoft Office release technical library:
Appendix of KB Articles
The following Microsoft Knowledge Base (KB) articles describe the Microsoft Office Service Pack 3 (SP3) downloads for individual programs:
• Description of the Office 2003 Service Pack 3 (also covers Office MUI SP3) - KB Article 923618
• Description of the Visio 2003 Service Pack 3 (also covers Visio MUI SP3) - KB Article 923620
• Description of the Project 2003 Service Pack 3 (also covers Project MUI SP3) - KB Article 923622
• Description of the OneNote 2003 Service Pack 3 - KB Article 923633
• Description of the Office 2003 Service Pack 3 for Proofing Tools - KB Article 923642
• Description of the Windows SharePoint Services Service Pack 3 - KB Article 923643
• Description of the SharePoint Portal Server 2003 Service Pack 3 - KB Article 923644
• Description of the Project Server 2003 Service Pack 3 (also covers Project Sever MUI SP3) - KB Article 923645
• Description of the Windows SharePoint Services Service Pack 3 (also covers Language Template Pack) - KB Article 923647
• Description of the Outlook Live 2003 Service Pack 3 - KB Article 923648
• Description of the Office 2003 Service Pack 3 for Language Interface Pack - KB Article 923649
• Description of the Word Viewer 2003 Service Pack 3 - KB Article 934736
• Description of the Excel Viewer 2003 Service Pack 3 - KB Article 934737
The following KB Articles list the issues fixed in Office 2003 SP3:
• The 2003 Microsoft Office release - KB Article 938792
• Microsoft Office Access 2003 - KB Article 938792
• Microsoft Office Excel 2003 - KB Article 938790
• Microsoft Office InfoPath 2003 - KB Article 938792
• Microsoft Office Outlook 2003 - KB Article 938802
• Microsoft Office PowerPoint 2003 - KB Article 938801
• Microsoft Office Project 2003 - KB Article 938797
• Microsoft Office Visio 2003 - KB Article 938794
• Microsoft Office Word 2003 - KB Article 938799
• Microsoft Office Isolated Conversion Environment (MOICE) - KB Article 935865
• File Block - Microsoft Security Advisory 937696, KB Article 922849, KB Article 922848, and KB Article 922847
The following KB Articles detail various issues fixed in Office 2003 SP3:
• How to disable the DWG file format in Visio 2003 with Service Pack 3 - KB Article 938803
• You see an error message when you try to open a password-protected Project 2007 file in Project 2003 - KB Article 938804
• How to disable the help pane which appears when you open a Project 2007 file in Project 2003 - KB Article 938805
• After you install Office 2003 Service Pack 3, files in the Excel 95 format that contain Visual Basic for Applications macros do not open as expected - KB Article 938806
• After you install Office 2003 Service Pack 3, documents saved in certain formats no longer contain the version number of Office - KB Article 938807
• Fast Save setting in Microsoft Office Word is ignored after you install Office 2003 Service Pack 3 - KB Article 938808
• After you install Office 2003 Service Pack 3, you cannot install Access add-ins for use by all users - KB Article 938809
• File formats that are blocked in Excel 2003, PowerPoint 2003 and Word 2003 after you install Office 2003 Service Pack 3 - KB Article 938810
• Files with the .gadget extension cannot be opened in Outlook 2003 after Service Pack 3 has been applied - KB Article 938811
• You may experience issues when you run the Microsoft Office Document Imaging program after you install Office 2003 Service Pack 3s to Microsoft Office Document Imaging in Office 2003 Service Pack 3 - KB Article 938813
• The functionality of an add-in, an ActiveX control, or a COM add-in is reduced, or the functionality is blocked after you install Office 2003 Service Pack 3 - KB Article 938814
• Office 2003 SP3 COM Allow / Deny / Component Category Checks - KB Article 938815
• Outlook How-to Unblock restricted MAPI Forms running from public folders or user folders - KB Article 938816
• How to change the number of embedded mime messages processed before dumping mime to the message body - KB Article 938817
• After you install Project 2003 Service Pack 3, you may receive an error message when you try to open or save a file format in Project 2003 - KB Article 941466
• After you install Office 2003 Service Pack 3, Office can no longer open or save certain file formats in Excel 2003, PowerPoint 2003, and Word 2003 - KB Article 941636
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
This white paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS
DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in, or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
© 2007 Microsoft Corporation. All rights reserved.
Microsoft, Access, ActiveX, Excel, FrontPage, Hotmail, InfoPath, Internet Explorer, OneNote, Outlook, PowerPoint, SharePoint, Visio, Visual Basic, Windows, Windows Live, and Windows Vista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective owners. [pic][pic]
-----------------------
[1] Kark, Khalid. “Calculating the Cost of a Security Breach.” Forrester Research, April 2007. hÿ#Éhÿ#ÉCJ
aJ
hcpŽh„AoCJOJQJaJhcpŽhcpŽCJHYPERLINK ""
[2] Microsoft Antimalware Team. “Windows Malicious Software Removal Tool: Progress Made, Trends Observed.” November 2006.
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related searches
- white paper format microsoft word
- white paper template
- writing a white paper template
- how to write a white paper examples
- best white paper examples
- basic white paper template
- white paper 6 south africa
- business white paper example
- writing a white paper guidelines
- examples of white paper template
- one page white paper example
- technical white paper template word