Microsoft Office Security Updates

Defects are regularly found in Microsoft Office products that break security and leave computers vulnerable to criminals and viruses. Maliciously designed documents normally thought to be safe ( e.g. Word documents, PowerPoint presentations, Visio diagrams, Excel spreadsheets, Access databases ) can exploit the defects to compromise a computer. These defects are fixed by periodic security updates.

Updates for Windows versions of Microsoft Office 2002, Office XP and Office 2003 products will usually be automatically updated if the computer is set up according to StartSafe recommendations.

Other updates are not so easy. These include Windows Office 2000 ( including Outlook 2000 ), Office for Macintosh products, and Microsoft Works.

Office 2000 and Microsoft Works currently must be updated by the operator periodically visiting Microsoft's Office Update web site.

Office for Macintosh products can be updated by manually downloading the updates available on the Microsoft Macintosh downloads web site . Office for Macintosh 2004 also supports automatic updates as described on this San Francisco State University web page.

Microsoft article detailing patch coverage for their various products.

Windows Original installation media requirement

Microsoft Office update installations often require the original installation media to be present. If the installation was performed using a CD, that CD will need to be inserted when prompted. If the installation was performed from a network drive, that network drive needs to be available during the update installation process.

More information on installation media requirements:

• Windows Installer 2.0  minimizes the frequency of needing the original installation media for Office updates. This should be installed automatically through Windows update mechanisms if the computer is set up according to StartSafe recommendations.
• An Office 2000 update the reduces need for installation media
• Sometimes, this can be avoided by downloading a "full, administrative" or "network" installation rather than the smaller one that grabs what it needs as it is being installed. However, there are cases when installation media is even needed for these but there are some workarounds.
• Why service packs, updates, and security patches may require the Office 2000 CD-ROM
• Service packs, updates, and security patches may require the Office XP CD-ROM

Windows Office 2000 Service Packs

The updates for all Office versions (2000, 2002,XP,2003) require the latest service pack(s) before they will work. Service packs for Office 2000 can only be obtained by visiting the Microsoft Office Update web site or by manual download and install.

• Office 2000 Service Pack 3  ( requires Office 2000 Service Release SR1 )  and Office 2000 Service Pack 3 for Office 2000 Service Release SR1 multilanguage pack

In each case, the default download link or button on the pages above, downloads and runs a stub installer that fetches the remaining needed software. It has been reported that the incidence of needing access to the original installation media during installation is minimized by downloading the full administrative download (see below) rather than the default client download.

Full Administrative Downloads

• Office 2000 Service Pack 3 requires Office 2000 Service Release SR1

The updates also require Microsoft Windows Installer 2.0 but this should be present if the latest Windows service packs are installed.

Windows Updates for Office 2000, Outlook 2000, and associated language packs

Updates can only be obtained by visiting the Microsoft's Office update web site or by manual download and install. The latest Service Packs must be installed first or the updates will not be offered or will not install.

All security updates offered by the Microsoft's Office update web site should be installed. However, some that are of particular importance are listed below. The links will take you to information and download locations.

• Outlook 2000 MS06-003 KB 902412 - the defect allows a computer to be compromised simply by previewing or opening a maliciously formatted e-mail message
• Office MS06-012 KB905413 - the defect is reportedly being exploited in malicious PowerPoint documents and can compromise a computer with Office 2000 installed just by visiting a malicious web page
• Multiple Critical Excel Security Defects MS06-037. Some of these are reportedly being exploited.
• Multiple Critical Office Security Defects MS06-038
• Multiple Critical Office Security Defects MS06-047
• Multiple Critical Office Security Defects MS06-048

Miscellaneous Issues

• Office Update offers updates for products you do not have installed

Desktop management resources:

• Office Administration Update Center
• Troubleshooting Office Update
• Office XP Deployment Guide
• How to determine the version of your Office 2000 installation
• How to determine whether SR1 or SR1a is installed on your Office 2000 installation
• How to check the version of Office XP
• How to check the version of Office 2003
• Using ABOUT to check version of Office XP or 2003 may be misleading
• Bug causing installations to request media even when files aren't replaced

• Full Administrative Downloads for service packs

  • Office 2000 Service Pack 3 requires Office 2000 Service Release SR1
  • Office XP Service Pack 3 and Office XP Service Pack 3 for Multilingual language packs