Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Description of the security update for Outlook 2007: June 13, 2017


View products that this article applies to.

Summary

This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2017-8506, Microsoft Common Vulnerabilities and Exposures CVE-2017-8507, and Microsoft Common Vulnerabilities and Exposures CVE-2017-8508.

Note To apply this security update, you must have the release version of Service Pack 3 for the 2007 Microsoft Office suite installed on the computer.

Important This article contains information that shows you how to help to lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, Microsoft recommends that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you choose to implement this workaround, take any appropriate additional steps to help to protect your system

↑ Back to the top


Known issues in this security update

Issue 1

When you open an attachment in an email, contact, or task formatted as Rich Text you get the following error:

"The program used to create this object is Outlook. That program is either not installed on your computer or it is not responding. To edit this object, install Outlook or ensure that any dialog boxes in Outlook are closed".

Issue 2

When you open an attachment that includes consecutive dots (...), or an exclamation point (!), the files are blocked and you receive a warning message. See You receive an error when opening attachments in Outlook for more information.

Issue 3

If an email message includes an attached email message, and the attached email message's subject line ends with an unsafe file name extension as listed in the Blocked attachments in Outlook page, the email attachment will be blocked for recipients. To work around this issue, the sender can rename the attachment so that it does not end with an unsafe file name extension. Then, attach it to the email message to be sent.

Issue 4

Issue 5

iCloud fails to load properly in Outlook 2007. When accessing Calendar, Contacts, or Tasks in Outlook 2007, you receive the following error:

The set of folders cannot be opened.
MAPI was unable to load the information service C:\PROGRA~2\COMMON~1\Apple\Internet Services\APLZOD.dll. Be sure the service is correctly installed and configured.


Status

The loading of unregistered MAPI services has been disabled by default to make Outlook more secure.


Workaround

Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. Microsoft does not recommend this workaround but is providing this information so that you can choose to implement this workaround at your own discretion. Use this workaround at your own risk.

If you have trusted applications that depend on being loaded in this manner, you can re-enable those applications by setting the following registry key:

REG_DWORD HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

You can use the following registry subkey to apply the registry setting as a domain policy:

HKCU\Software\Policies\Microsoft\Office\12.0\Outlook\Security\AllowUnregisteredMapiServices

 

Value 0 (default): Block loading of unregistered MAPI services. This is the recommended setting to avoid unexpected execution of unknown code

Value 1: Enable loading of unregistered MAPI services.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows
 

To make these registry changes, follow these steps:

  1. Click Start, click Run, type regedit in the Open box, and then click OK.
  2. Locate and then click the following subkey in the registry:
    HKCU\Software\Microsoft\Office\12.0\Outlook\Security\
  3. On the Edit menu, point to New, and then click DWORD Value.
  4. Type AllowUnregisteredMapiServices for the name of the DWORD, and then press Enter.
  5. Right-click AllowUnregisteredMapiServices, and then click Modify.
  6. In the Value data box, type 1 to enable the registry entry, and then click OK.
    Note To disable the AllowUnregisteredMapiServices setting, type 0 (zero), and then click OK.
  7. Exit Registry Editor, and then restart the computer.


Vulnerability information (applies to all versions)

MAPI does not validate that a provider’s DLL that it is requested to load is registered correctly in MapiSVC.inf or even that it comes from the local machine. This can be exploited by creating a file together with an OLE object in such a way to cause MAPI to load a DLL from a network share when the OLE object is activated. This can allow arbitrary code execution to occur.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

↑ Back to the top


How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

↑ Back to the top


More Information

Security update deployment information

For deployment information about this update, see security update deployment information: June 13, 2017.

Security update replacement information

This security update does not replace any previously released update.

File hash information

Package Name Package Hash SHA 1 Package Hash SHA 2
outlook2007-kb3191898-fullfile-x86-glb.exe ACAA487F89E2995DEBE4BADCB84A748AC0965595 759D681EB22F7B20695D97D12DD0D939B8A744489766719A5B630F1C12F8D6FC

File information

The English version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight-saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.


For all supported x86-based versions of Outlook 2007

File identifier File name File version File size Date Time
Contab32.dll Contab32.dll 12.0.6650.5000 128,376 30-Aug-2011 17:46
Dlgsetp.dll Dlgsetp.dll 12.0.6658.5000 88,368 07-Feb-2012 22:47
Dumpster.dll Dumpster.dll 12.0.6650.5000 34,208 30-Aug-2011 17:46
Envelope.dll Envelope.dll 12.0.6652.5000 154,000 21-Sep-2011 13:43
Impmail.dll Impmail.dll 12.0.6658.5000 138,536 07-Feb-2012 22:47
Mimedir.dll Mimedir.dll 12.0.6658.5000 340,760 07-Feb-2012 22:47
Olkfstub.dll Olkfstub.dll 12.0.6650.5000 253,824 30-Aug-2011 17:46
Olmapi32.dll Olmapi32.dll 12.0.6770.5000 3,095,808 03-Jun-2017 15:32
Omsmain.dll Omsmain.dll 12.0.6713.5000 662,728 18-Nov-2014 08:00
Omsxp32.dll Omsxp32.dll 12.0.6713.5000 195,288 18-Nov-2014 08:00
Outlmime.dll Outlmime.dll 12.0.6755.5000 600,368 16-Aug-2016 18:03
Outlook.exe Outlook.exe 12.0.6770.5000 12,967,656 03-Jun-2017 15:32
Outlph.dll Outlph.dll 12.0.6670.5000 177,272 07-Nov-2012 15:02
Outlvba.dll Outlvba.dll 12.0.6713.5000 52,920 18-Nov-2014 07:53
Pstprx32.dll Pstprx32.dll 12.0.6658.5000 422,184 07-Feb-2012 22:47
Recall.dll Recall.dll 12.0.6658.5000 38,696 07-Feb-2012 22:47
Rm.dll Rm.dll 12.0.6650.5000 75,624 30-Aug-2011 17:46
Rtfhtml.dll Rtfhtml.dll 12.0.6658.5000 411,440 09-Feb-2012 04:30
Scanost.exe Scanost.exe 12.0.6650.5000 54,104 30-Aug-2011 17:46
Scnpst32.dll Scnpst32.dll 12.0.6650.5000 273,832 30-Aug-2011 17:46
Scnpst64.dll Scnpst64.dll 12.0.6650.5000 282,032 30-Aug-2011 17:46

↑ Back to the top


How to get help and support for this security update

Help for installing updates: Windows Update FAQ

Security solutions for IT professionals:
TechNet Security Support and Troubleshooting

Help for protecting your Windows-based computer from viruses and malware:
Microsoft Secure

Local support according to your country:
International Support

Propose a feature or provide feedback on Office Core: Office User Voice portal

 

↑ Back to the top


Keywords: kbBug, kbfix, kbsurveynew, kbExpertiseInter, KbSECBulletin, KbSECVulnerability, ATdownload, kbMustLoc, kbLangAll, kbSecurity, Known Issues, Known issues, kbSecReview

↑ Back to the top

Article Info
Article ID : 3191898
Revision : 30
Created on : 4/13/2020
Published on : 4/16/2020
Exists online : False
Views : 174