MS04-009 addresses a security vulnerability which exists within Outlook 2002 that could allow Internet Explorer to execute script code in the Local Machine zone on an affected system. To exploit this vulnerability, an attacker would have to host a malicious Web site that contained a Web page designed to exploit the vulnerability and then persuade a user to view the Web page.

Since users are only at risk when Outlook 2002 is configured as the default mail reader and when the "Outlook Today" home page is their default folder home page, you can disable Outlook Today by unchecking the option to show a folder homepage by default to fix this vulnerability.

Note that if an attacker exploited this vulnerability, the attacker would gain only the same privileges as the user. This means users whose accounts are configured to have few privileges on the system would be at less risk than users who operate with administrative privileges. This is why no one recommends logging on to administrator accounts for normal usage, even though it is more convenient.

Only Outlook 2002-SP2 is affected by this exploit, Outlook 98, 2000, and 2003 are not affected, however, anyone who doesn't use Outlook Today can disable it as a precaution. To disable Outlook Today, right click on the top level folder in the mailbox or personal folders. (It's the folder with the little house icon.) Choose Properties, then Home Page and remove the check from "Show home page by default for this folder".

As I mentioned earlier, updating to Outlook 2002 SP3 fixes the exploit but may create more problems. After installing Outlook 2002 SP3 you many see the "a program is trying to access...allow it for 1 minute" security warning.

This warning message is a result of Outlook 2002 SP3 adding additional properties to the list of those that are affected by the security features, properties which are blocked by Outlook 2003. Anti-spam add-ins, which read the message body as part of their anti-spam scanning, are a common cause, although others are affected by the changes as well. Many add-ins were updated following the release of Outlook 2003 and should work with SP3, but many others need re-engineered to work with Outlook 2002 SP3. Until the add-ins which cause this warning are updated, you'll need to either live with the warning or disable the add-in, as SP3 cannot be uninstalled. If you use a version of Windows that supports System Restore, you may be able use a restore point to remove SP3.

Like many visitors to the Microsoft newsgroups (at msnews.microsoft.com) you're probably wondering: "Didn't Microsoft test this?" Well, yes, but...Service Packs usually have a limited number of outside beta testers and the beta notes did not mention security changes. Apparently few, if any, beta testers used programs that triggered the warnings in Outlook, so no one knew about the security changes prior to the official release, or which add-ins would trigger the security warnings. Additionally, in a move that is inexcusable, release notes did not mention the security changes and the KB articles covering the changes were not available at the time of SP3's release.

Administrators should not apply this Service Pack on production systems until thoroughly testing it with their custom applications and forms first. My personal recommendation is to wait at least two weeks to see what develops. While I don't believe Microsoft will re-release the patch with these new security features removed, waiting will give vendors time to update their software, resulting in less inconvenience to users. Note that while Outlook is getting all the attention, there are some minor issues with Excel and Word as well.

Product availability and resources For more information on disabling the Outlook Today exploit, visit http://www.microsoft.com/technet/security/Bulletin/MS04-009.mspx. You can test Outlook by visiting http://www.nettwerked.co.uk/code/outlooksploit.html or learn more about the test at http://www.securityfocus.com/archive/1/357055/2004-03-10/2004-03-16/0. For the latest information on Outlook 2002 SP3, including a list of applications and add-ins known to be affected, see http://www.slipstick.com/outlook/ol2002sp3.htm. Developers can learn more about changes brought about in SP3 by visiting http://www.outlookcode.com/d/sec.htm. Information concerning changes that affect custom forms is at http://www.outlookcode.com/d/secforms.htm. For a list of all issues that are fixed for Microsoft Outlook 2002 in Service Pack 3, see Description of Microsoft Office XP Service Pack 3, visit http://support.microsoft.com/default.aspx?kbid=836033. Custom solutions and add-ins that integrate with Outlook 2002 are affected after you apply Office XP Service Pack 3 (SP3) can be found at http://support.microsoft.com/default.aspx?kbid=838871. To download Office SP3, visit http://www.microsoft.com/downloads/details.aspx?familyid=85af7bfd-6f69-4289-8bd1-eb966bcdfb5e. Note that SP3 contains all updates included in Office XP Service Pack 1 (SP1) and Office XP Service Pack 2 (SP2), and updates released after SP2.

Diane Poremsky is the president of CDOLive LLC and a Microsoft Outlook MVP. She's author of Teach Yourself Outlook 2003 in 24 Hours (Sam's, 2003) and coauthor of OneNote 2003 for Windows (Visual QuickStart Guide). For questions or suggestions for future columns, write her at outlook@cdolive.com.