Microsoft Security Bulletin MS07-003 - Vulnerabilities in Microsoft Outlook Could Allow Remote Code Execution (925938)

This critical bulletin affects all version of Outlook except 2007.  Outlook Express is apparently not impacted.  The patch fixes 2 arbitrary code and 1 denial of service vulnerabilities.  The denial of service vulnerability is publicly disclosed.  One of the arbitrary code vulnerabilities is particularly worrisome since it involves iCal calendar appointments received in emails or opened otherwise.  The vulnerability doesn’t apply to iCals received via an Exchange account since Outlook uses MAPI with Exchange.  Vectors are limited to receiving email via POP, IMAP or HTTP or by opening an iCal file from some other source such as from a web page. 
There is a published workaround which involves one of several ways of disabling the MapiCvt class which provides Outlook’s calendar event handling.
For clients known to receive email via POP, IMAP or HTTP I recommend patching after minimal testing or implementing the work around immediately.
If possible block the download iCal files at your web gateway to prevent the browser based vector.
Otherwise I recommend patching after full testing.

Get this valuable commentary each month as soon as Microsoft releases security updates!

Free log parser scripts, a clear explanation of Microsoft's latest security bulletin, helpful security tips, how-to's and more.