|
Greetings! Welcome to Vol. 5, No. 20, of Exchange Messaging
Outlook, a biweekly newsletter about Microsoft Exchange and
Microsoft Outlook.
Today's highlights:
- Preview Office XP and Outlook 2002
- New Outlook vulnerability patch
- Redeeming the Outlook E-mail Security Update
Regular features:
- New utilities
-
Updated utilities
- Other new resources
Please note: the links contained in this article
were accurate as of the date of this publication. We cannot
guarantee the accuracy at a later date.
Preview Office XP and Outlook 2002
While supplies last, Microsoft is distributing the Office XP
Professional with Microsoft FrontPage Corporate Preview Beta, which
includes the next version of Outlook -- Outlook 2002. MSDN Universal
subscribers will get it in their March shipment; TechNet Plus
subscribers in April. Everyone else can order it now for $19.95 from
https://microsoft.order-1.com/officecpp/.
We strongly recommend that you install this beta only on test
systems. Two other things to note: Outlook 2002 includes all the
features of the Outlook E-mail Security Update. And, you must be
connected to the Internet to activate Office XP using the new
anti-piracy protection scheme in this version.
This beta expires August 31, 2001, and Microsoft provides no
product support. Use at your own risk ... but have fun!
New Outlook vulnerability patch
Microsoft has posted patches for Internet Explorer 5.01 SP1 and
5.5 SP1 to resolve a "Malformed vCard" vulnerability in Outlook.
This vulnerability could allow a malicious sender to run code on
your system. See
http://www.microsoft.com/technet/security/bulletin/ms01-012.asp
for more details.
By the way, you won't find this patch for Outlook listed on
Microsoft's Office Update site at
http://www.officeupdate.com.
It's one of several security patches related to the web components
in Outlook (those shared with Outlook Express) that need to be
updated with a download for Internet Explorer. Yet, despite the risk
that these security loopholes present, Microsoft continues to omit
information about these patches from the Office Update site and
doesn't include them in Office Auto Update Notification Service
mailings. Given Microsoft's strong actions on security, such as the
Outlook Email Security Update, we don't understand why Office Update
shouldn't provide a complete list of patches affected Outlook, both
those from the Office team and those from the IE team.
Just so you don't have to scour Microsoft for these patches, we
keep a complete list at
http://www.slipstick.com/outlook/antivirus.htm and
http://www.slipstick.com/outlook/htmlmail.htm.
Redeeming the Outlook E-mail Security Update
We have documented many ways to get around the attachment
blocking feature of the Outlook E-mail Security Update (http://www.slipstick.com/outlook/esecup/getexe.htm),
but until now there was no workaround for the "object model guard"
except to recode your program with Extended MAPI. The object model
guard inhibits access to the address book and message sending by
presenting a dialog box where the user must authorize access. For
some applications, like mass mailings, this pretty much kills the
application.
Now a new developer toolkit, Outlook Redemption (http://www.dimastr.com/redemption/),
provides a safe way for your Outlook code to run without triggering
the object model guard dialogs. It also adds some capabilities that
the Outlook object model does not provide, such as getting the
sender's e-mail address, opening a saved message .msg file and
directly accessing the rich-text content of an Outlook item.
|