Description of the security update for Outlook 2007: June 13, 2017

Summary

This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2017-8506, Microsoft Common Vulnerabilities and Exposures CVE-2017-8507, and Microsoft Common Vulnerabilities and Exposures CVE-2017-8508.

Note To apply this security update, you must have the release version of Service Pack 3 for the 2007 Microsoft Office suite installed on the computer.

Important This article contains information that shows you how to help to lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, Microsoft recommends that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you choose to implement this workaround, take any appropriate additional steps to help to protect your system

Known issues in this security update

Issue 1

When you open an attachment in an email, contact, or task formatted as Rich Text you get the following error:“The program used to create this object is Outlook. That program is either not installed on your computer or it is not responding. To edit this object, install Outlook or ensure that any dialog boxes in Outlook are closed”. You may also see:“This item contains attachments that are potentially unsafe. You may not be able to view these attachments after you close them”. See You receive an error when opening attachments in Outlook for more information.

Issue 2

When you open an attachment that includes consecutive dots (…), or an exclamation point (!), the files are blocked and you receive a warning message. See You receive an error when opening attachments in Outlook for more information.

Issue 3

If an email message includes an attached email message, and the attached email message’s subject line ends with an unsafe file name extension as listed in the Blocked attachments in Outlook page, the email attachment will be blocked for recipients. To work around this issue, the sender can rename the attachment so that it does not end with an unsafe file name extension. Then, attach it to the email message to be sent.

Issue 4

When you use a custom form that you have created for Outlook, you see the following two symptoms:

• VBScript does not run.
• You get a malicious code warning

See You receive an error when opening attachments in Outlook for more information.

Issue 5

iCloud fails to load properly in Outlook 2007. When accessing Calendar, Contacts, or Tasks in Outlook 2007, you receive the following error:

The set of folders cannot be opened.
MAPI was unable to load the information service C:\PROGRA~2\COMMON~1\Apple\Internet Services\APLZOD.dll. Be sure the service is correctly installed and configured.

Status The loading of unregistered MAPI services has been disabled by default to make Outlook more secure. Workaround Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. Microsoft does not recommend this workaround but is providing this information so that you can choose to implement this workaround at your own discretion. Use this workaround at your own risk.If you have trusted applications that depend on being loaded in this manner, you can re-enable those applications by setting the following registry key:REG_DWORD HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security*AllowUnregisteredMapiServices* You can use the following registry subkey to apply the registry setting as a domain policy:HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Security*AllowUnregisteredMapiServices* Value 0 (default): Block loading of unregistered MAPI services. This is the recommended setting to avoid unexpected execution of unknown codeValue 1: Enable loading of unregistered MAPI services.Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:322756 How to back up and restore the registry in WindowsTo make these registry changes, follow these steps:

1. Click Start , clickRun, typeregeditin theOpenbox, and then clickOK.
2. Locate and then click the following subkey in the registry:HKCU\Software\Microsoft\Office\12.0\Outlook\Security\
3. On the Edit menu, point toNew, and then clickDWORD Value.
4. Type AllowUnregisteredMapiServices for the name of the DWORD, and then press Enter.
5. Right-click AllowUnregisteredMapiServices , and then clickModify.
6. In the Value data box, type1to enable the registry entry, and then clickOK. NoteTo disable theAllowUnregisteredMapiServicessetting, type0(zero), and then clickOK.
7. Exit Registry Editor, and then restart the computer.

Vulnerability information (applies to all versions) MAPI does not validate that a provider’s DLL that it is requested to load is registered correctly in MapiSVC.inf or even that it comes from the local machine. This can be exploited by creating a file together with an OLE object in such a way to cause MAPI to load a DLL from a network share when the OLE object is activated. This can allow arbitrary code execution to occur.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

• Download the security update KB3191898 for the 32-bit version of Outlook 2007

---

More Information

Security update deployment information

For deployment information about this update, see security update deployment information: June 13, 2017.

Security update replacement information

This security update does not replace any previously released update.

File hash information

Package Name	Package Hash SHA 1	Package Hash SHA 2
outlook2007-kb3191898-fullfile-x86-glb.exe	ACAA487F89E2995DEBE4BADCB84A748AC0965595	759D681EB22F7B20695D97D12DD0D939B8A744489766719A5B630F1C12F8D6FC

File information

The English version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight-saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.
For all supported x86-based versions of Outlook 2007| File identifier| File name| File version| File size| Date| Time
—|—|—|—|—|—
Contab32.dll| Contab32.dll| 12.0.6650.5000| 128,376| 30-Aug-2011| 17:46
Dlgsetp.dll| Dlgsetp.dll| 12.0.6658.5000| 88,368| 07-Feb-2012| 22:47
Dumpster.dll| Dumpster.dll| 12.0.6650.5000| 34,208| 30-Aug-2011| 17:46
Envelope.dll| Envelope.dll| 12.0.6652.5000| 154,000| 21-Sep-2011| 13:43
Impmail.dll| Impmail.dll| 12.0.6658.5000| 138,536| 07-Feb-2012| 22:47
Mimedir.dll| Mimedir.dll| 12.0.6658.5000| 340,760| 07-Feb-2012| 22:47
Olkfstub.dll| Olkfstub.dll| 12.0.6650.5000| 253,824| 30-Aug-2011| 17:46
Olmapi32.dll| Olmapi32.dll| 12.0.6770.5000| 3,095,808| 03-Jun-2017| 15:32
Omsmain.dll| Omsmain.dll| 12.0.6713.5000| 662,728| 18-Nov-2014| 08:00
Omsxp32.dll| Omsxp32.dll| 12.0.6713.5000| 195,288| 18-Nov-2014| 08:00
Outlmime.dll| Outlmime.dll| 12.0.6755.5000| 600,368| 16-Aug-2016| 18:03
Outlook.exe| Outlook.exe| 12.0.6770.5000| 12,967,656| 03-Jun-2017| 15:32
Outlph.dll| Outlph.dll| 12.0.6670.5000| 177,272| 07-Nov-2012| 15:02
Outlvba.dll| Outlvba.dll| 12.0.6713.5000| 52,920| 18-Nov-2014| 07:53
Pstprx32.dll| Pstprx32.dll| 12.0.6658.5000| 422,184| 07-Feb-2012| 22:47
Recall.dll| Recall.dll| 12.0.6658.5000| 38,696| 07-Feb-2012| 22:47
Rm.dll| Rm.dll| 12.0.6650.5000| 75,624| 30-Aug-2011| 17:46
Rtfhtml.dll| Rtfhtml.dll| 12.0.6658.5000| 411,440| 09-Feb-2012| 04:30
Scanost.exe| Scanost.exe| 12.0.6650.5000| 54,104| 30-Aug-2011| 17:46
Scnpst32.dll| Scnpst32.dll| 12.0.6650.5000| 273,832| 30-Aug-2011| 17:46
Scnpst64.dll| Scnpst64.dll| 12.0.6650.5000| 282,032| 30-Aug-2011| 17:46

How to get help and support for this security update

Help for installing updates: Windows Update FAQ

Security solutions for IT professionals: TechNet Security Support and Troubleshooting

Help for protecting your Windows-based computer from viruses and malware: Microsoft Secure

Local support according to your country: International SupportPropose a feature or provide feedback on Office Core: Office User Voice portal