Office 2003 Security Tightened

Most organizations running Office 2003 will want to deploy Service Pack 3 (SP3), which closes serious security holes and fixes other bugs. However, SP3 will require more testing than some past Office security packs because of potential compatibility problems.

The most important changes in SP3 fix a rash of security vulnerabilities discovered over the past year, some of which enable attackers to remotely execute code on affected systems. However, the security lockdown has had side effects that could affect compatibility and performance, for example:

• Some COM add-ins, ActiveX controls, and other add-ins will be blocked by default
• Some file import/export formats (e.g., Corel Draw) are blocked by default
• Excel 4.0 macros (still found in some older Excel files) will not execute by default
• The Word 2003 “fast save” has been completely disabled to prevent deleted comments or other potentially embarrassing hidden data from leaking into files.

Administrators can deploy Registry changes to deal with some but not all of these problems. SP3 also cannot be uninstalled except by uninstalling Office. Consequently, it should receive especially thorough testing before mass deployment.