Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: PSI says Word 2007 is insecure, but no updates are available

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
Programs

Relating to this vendor:
Microsoft
And, this specific program:
Microsoft Office Word 2007

This thread has been marked as locked.
ChrisCar PSI says Word 2007 is insecure, but no updates are available
Member 31st Aug, 2009 01:44
Ranking: 0
Posts: 4
User Since: 30th Aug, 2009
System Score: N/A
Location: N/A
I've searched the forum, but this doesn't seem to exist for Word 2007 so I'm starting a new thread.

PSI reports that my version of Word 2007 (also also PowerPoint and Excel 2007) is insecure. When I click "download solution" it launches Windows Update and there are no updates available.

Clicking "Technical Details" yields the following:

"Technical details about this installation of Microsoft Office Word 2007, you can use this information to determine why the Secunia PSI detected the program and the security state of it.

"Version Detected:
12.0.6425.1000

"Installation Path:
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

"Last Inspection of Program:
30th Aug. 2009, 18:48 CET"

As stated above, the same warning appears for PowerPoint and Excel, and again there are no updates to be gotten from Microsoft. Can anyone shed some light on this, please? Many thanks.

Chris

thedillpickl RE: PSI says Word 2007 is insecure, but no updates are available
Contributor 31st Aug, 2009 08:51
Score: 376
Posts: 872
User Since: 3rd May 2009
System Score: 100%
Location: US
Hi Chris;

Windows Update dosn't always "update". Try this link, it's fairly easy to navigate. http://www.microsoft.com/downloads/en/default.aspx Let us know how it goes.


regards;

Fred

--
XP Home
Chrome, Firefox, IE8
--
consilio et animis
Was this reply relevant?
+0
-0
Maurice Joyce RE: PSI says Word 2007 is insecure, but no updates are available
Handling Contributor 31st Aug, 2009 10:58
Score: 11782
Posts: 9,032
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Chris,
I use Office 2007. I am very surprised Microsoft update is not picking up the updates - never failed me with office 2003 or 2007.

The latest Word is 12.0.6504.5000

I few things U might like to check.
1. Have U got SP3 installed for XP or SP2 for Vista?
2. Have U opted out of Windows Genuine Advantage/Office Genuine Advantage?
3. Have U tried to update using each individual Microsoft programme by using the built in Updater? The link is in each programme under Options>resources where U will also find all the help U require on all aspects of the Office 2007 Suite.

The site for 2007 is here:
http://office.microsoft.com/en-gb/downloads/CD1020...

Without wishing to teach "granny to suck eggs" U should avoid installing any 2007 VIEWERS or the COMBATIBILITY PACK as they not for Office 2007 users.



--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
ChrisCar RE: PSI says Word 2007 is insecure, but no updates are available
Member 1st Sep, 2009 02:29
Score: 0
Posts: 4
User Since: 30th Aug 2009
System Score: N/A
Location: N/A
Fred and Maurice:

Thank you both for your suggestions. Unfortunately, they did not resolve the issue. Here is more information.

1. I'm running Vista SP2 (64-bit, in case it matters).

2. I have NOT opted out of Genuine Advantage and I am confirmed validated.

3. I had not attempted to update each program individually until you suggested it. I have now done so without success. Clicking the update button takes me to: http://update.microsoft.com/microsoftupdate/v6/vis...
and also launches Control Panel -> Windows Update. The only update available on that screen is the "Office Live add-in 1.4" which I understood wasn't needed if not using Office Live. Am I incorrect about that? Perhaps that's the missing update?

As an aside, I went into Control Panel -> Programs and poked around. There were indeed installations of a Compatibility Pack and PowerPoint Viewer 2007. I have no recollection of installing them, but I have now removed them. (This did not fix the problem, however). Secunia still reports Excel, PowerPoint and Word as insecure.

I welcome any further suggestions/advice. Thank you.

Chris
Was this reply relevant?
+0
-0
Maurice Joyce RE: PSI says Word 2007 is insecure, but no updates are available
Handling Contributor 1st Sep, 2009 08:31
Score: 11782
Posts: 9,032
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Last edited on 1st Sep, 2009 08:33
Chris,
I would try to install SP2 & go from there. This came via Microsoft update in April this year.

http://www.microsoft.com/downloads/details.aspx?Fa...

SP2 should be showing in add/remove.

June this year was also another critical month for Office 2007. Numerous security enhancements were offered.

We will see how U get on with latest idea. If need be I can extract the updates by KB number & U can check if U have them installed.

Edit: U are correct. The 1.4 add in is a side issue.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
ChrisCar RE: PSI says Word 2007 is insecure, but no updates are available
Member 1st Sep, 2009 22:20
Score: 0
Posts: 4
User Since: 30th Aug 2009
System Score: N/A
Location: N/A
I followed your link to the Office 2007 SP2 update. When I ran it, it told me the update was already installed and terminated. I then went into my update history and found the following updates which are installed and pertain to Office or programs therein. This list is in chronological order with the most recently installed listed last.

Update for Microsoft Office Excel 2007 Help (KB963678)
Update for the 2007 Microsoft Office System (KB967642)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for the 2007 Microsoft Office System Help for Common Features (KB963673)
Update for Microsoft Office PowerPoint 2007 Help (KB963669)
Update for Microsoft Office OneNote 2007 Help (KB963670)
The 2007 Microsoft Office Suite Service Pack 2 (SP2)
* Microsoft Office Compatibility Pack Service Pack 2 (SP2)
* PowerPoint Viewer 2007 Service Pack 2 (SP2)
[I removed the last two yesterday based upon your earlier post.]
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for the 2007 Microsoft Office System (KB969559)
Security Update for Microsoft PowerPoint 2007 (KB957789)
Security Update for PowerPoint Viewer 2007 (KB970059)
Security Update for the 2007 Microsoft Office System (KB969613)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for the 2007 Microsoft Office System (KB969618)
Security Update for the 2007 Microsoft Office System (KB969679)

Windows still reports that there are no other updates to be had for Office 2007. Now I'm very perplexed. Thanks again for your help.

Chris
Was this reply relevant?
+0
-0
Maurice Joyce RE: PSI says Word 2007 is insecure, but no updates are available
Handling Contributor 1st Sep, 2009 23:33
Score: 11782
Posts: 9,032
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Chris,
Cross checked your updates against mine - I went back to the issue of SP1 in January 2009.

I only differ in the following:

KB960003 - link here
http://www.microsoft.com/downloads/details.aspx?fa...

KB959997 - link here
http://support.microsoft.com/kb/959997

These two were installed via Microsoft Update but I cannot now see them in add/remove.

This is really odd. Have U checked each programme via options>resources>about?

Word should say 12.0.6504.5000 SP2 MSO(12.0.6425.1000)

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
ChrisCar RE: PSI says Word 2007 is insecure, but no updates are available
Member 2nd Sep, 2009 02:20
Score: 0
Posts: 4
User Since: 30th Aug 2009
System Score: N/A
Location: N/A
Maurice:

I guess it was the update from your first link (KB960003) because after running that and re-scanning using PSI, now everything is fine. I'm at 100%!!

I also checked the options > resources > about screen and my version matches what you posted.

Thank you very, very much for your time and assistance.

Chris
Was this reply relevant?
+0
-0
Maurice Joyce RE: PSI says Word 2007 is insecure, but no updates are available
Handling Contributor 2nd Sep, 2009 09:25
Score: 11782
Posts: 9,032
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Clearly Microsoft update is keeping U up to date - why it missed that one in April 2009 baffles me.

In my view there are a lot of misleading posts on this forum regarding Microsoft Office particularly with those of us using one of the genuine 2007 Office Suites.

U do not require any standalone readers or the Compatibility Pack. All required updates are offered via Microsoft Update.

The resources option U have found should fix all things Office for U.

Pleased U are now OK again.

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
fobs RE: PSI says Word 2007 is insecure, but no updates are available
Member 7th Sep, 2009 05:44
Score: 0
Posts: 12
User Since: 16th Oct 2008
System Score: 100%
Location: N/A
I too have insecure messages from Secunia on a number of different Microsoft Office 2007 programs (Excel, InfoPath,PowerPoint, Publisher, and Word)and as all who have encountered this, I also went to Microsoft update and no updates were available. After reading some of the information on these forums and trying a number of options suggested, I ran my Belarc Advisor and discovered that the Service Pack 2 that was being recognised in Belarc shows as 954711, which is a DVD version of SP2, (http://support.microsoft.com/default.aspx?scid=kb;...) not as the 953195 listed as SP2 on Microsoft @http://www.microsoft.com/downloads/details.aspx?Fa...

This is the only common factor I can determine on each of the programs Secunia lists as insecure.

I do not know how Secunia flags an insecure program, but if this helps any users who also have Office 2007 Ultimate installed, please note that Microsoft has a disclaimer about using the DVD to load SP2 and it is at http://www.microsoft.com/downloads/details.aspx?di...

I had to reinstall Office 2007 after my motherboard failed and I used a DVD that I had purchased as part of a deal offered online to download Ultimate (a DVD with the program could be purchased for an additional fee and I elected to do that so I would have a CD in case of failure).

This link on Microsoft provides a checking tool to determine which Office updates are installed on a user's system: http://office.microsoft.com/en-us/downloads/defaul...
Choose the "Show Installed Office Updates" option on the left pane under Download Resources.

I have not yet uninstalled SP2 and reinstalled it to see if this corrects the problem, but will try and see if that does resolve the issue.

However, as a suggestion for Secunia, it would be helpful to provide exactly the KB update or MS bulletin that pertains to any given issue. Not knowing what needs to be patched is akin to being blind and walking down a well-lit path i.e. everything is there, but it is impossible to ascertain exactly what needs to be chosen.

I will also post this to the other threads for Office 2007 in the hope that others may consider these options.


--
ediabid
Was this reply relevant?
+0
-0
threepe RE: PSI says Word 2007 is insecure, but no updates are available
Member 9th Sep, 2009 21:28
Score: 0
Posts: 2
User Since: 9th Sep 2009
System Score: N/A
Location: N/A
Having a similar issue. Secunia says that my version of Word 2007 is insecure. I have just downloaded MBSA and it says all updates are in place.

I don't understand what is going on here :(

Also, I don't seem to be able to login to this forum in Firefox, had to use IE in the end to get in here :(
Was this reply relevant?
+0
-0
Maurice Joyce RE: PSI says Word 2007 is insecure, but no updates are available
Handling Contributor 9th Sep, 2009 22:14
Score: 11782
Posts: 9,032
User Since: 4th Jan 2009
System Score: N/A
Location: UK
Are you saying that a Word 2007 issue still exists after trying the recommendations on this thread?

--
Maurice

Windows 7 SP1 64 Bit OS
HP Intel Pentium i7
IE 11 for Windows 7 SP1
16GB RAM
Was this reply relevant?
+0
-0
threepe RE: PSI says Word 2007 is insecure, but no updates are available
Member 9th Sep, 2009 23:54
Score: 0
Posts: 2
User Since: 9th Sep 2009
System Score: N/A
Location: N/A
That is correct, after trying everything on this thread I still have the issue.

I am running Windows Vista, and hence have to use the update tool in the control panel. This says there are no updates to install, and I have not hidden any updates that are applicable.

Microsoft Security Baseline Analysis tool says that there is nothing left to install.

The Knowledge Base fixes listed above are not relevant to my software, and will not install.
Was this reply relevant?
+0
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability - Disclaimer