Does MSO3-050 apply to XL97 Pre-SR2?

[immanuel]

Would anyone know if XL97 Pre-SR2 is vulnerable to the security problem
discussed in the Microsoft Security Bulletin MSO3-050:

http://www.microsoft.com/technet/security/Bulletin/MS03-050.asp

 

[Dave Peterson]

From that link:

Microsoft Excel 97
Prerequisites Client Update
This security update requires Office 97 Service Release 2

===
Just a guess--yes, it's vulnerable, but you have to install SR2 before you can
get install the security patch to remove the vulnerability.

 

[immanuel]

Thanks. I'd guess that it would be vulnerable too. I was just hoping to
get something definitive (documented) to back it up.

One thing that makes me question the guess is the information found at
http://www.microsoft.com/security/bulletin where we find that the "Affected
Software Service Packs" include "Office XP SP2, Office 2000 Service Pack 3,
Office 97 SR-2/SR-2b". Yet the article itself doesn't make mention of patch
levels.

Regards,
Immanuel

 

[Dave Peterson]

I didn't see a definitive reference either.

But from what I recall of xl97, SR2 is something you should install anyway. I
think there were a few calculation problems with xl97 (or xl97SR1???).

 

[immanuel]

I agree completely. And some of the problems fixed by SR2 seem to be pretty
grave. But my customer seems reticent to roll out SR2 to his entire org for
some reason and seems to be particularly troubled by the vulnerability
discussed in MS03-050. My job, then, is to get something definitive...