Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With the end of mainstream support for Office 2003, it's tempting to retire Office 2003 from a managed network altogether (and replace with Office 2007, in our environment), but there are pockets of resistance (e.g. users who contractually share Access 2003 databases with large consortia internationally). Security is an effective rationale to compel users to upgrade, when it's defensible.

Does Office 2003 represent a security threat on a managed network, due to end of mainstream support?

EDIT: Much of our user base, and our back end, are moving to Office 2007 for Exchange and Sharepoint integration advantages - so sticking with 2003 in general is not the plan, and heterogeneity is a pain.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Office 2003 is safe, as long as you are running SP3 and patching. Microsoft continues to provide security fixes for the duration of the extended support cycle.

We had a similar issue with Access -- some users had Access applications that were essential to whatever they were doing. The solution is pretty simple -- you just configure the installer to leave Access 2003 behind! KB928091 discuses install order and some gotchas. (The big one is that you can only have one version of Outlook)

You're actually just as well that you've waited, Office 2007 SP2 fixed all sorts of pretty serious errors, particularly with Outlook calendaring with Exchange 2007.

share|improve this answer
    
Thanks! So, Access 2003 is compatible with the other pieces of Office 2007? –  Argalatyr Jul 18 '09 at 2:50
    
Everything except Outlook can co-exist. I added a link to a Microsoft KB article that discusses install order and some of the issues. Also, this is a perfect use case for software virtualization like Softgrid or thinstall. You may already own SoftGrid through your MS ELA and may own Thinstall if you have a VMWare license agreement. –  duffbeer703 Jul 18 '09 at 3:01

I would say that so long as there is a vector by which outside Microsoft Office 2003 documents can get to the PCs w/ Office 2003 installed it could legitimately argued that there is vulnerability. Having said that, I don't know what Microsoft's policy on issuing security-related patches is after the "mainstream support" period ends. A lot of companies are sticking with Office 2003 for now, and so long as there are enough Customers to create a ruckus when new "0 day vulnerabilities" in the Office 2003 products are found I would expect that Microsoft will continue to release security-related patches.

(Insert argument for open source software here... You can pay anyone you want to continue to "support" open source software w/o artifical "upgrade treadmills", etc...)

share|improve this answer
1  
During the extended support period, through 14 April 2014, security hotfixes are provided. –  Argalatyr Jul 18 '09 at 2:49
    
That would seem to answer your question. –  John Saunders Jul 18 '09 at 10:45
    
Not really - else I would not have asked. It's clear that Microsoft is providing less than full support for Office 2003, and it's likely that 2003 gets a lower priority for security fixes than 2007 (it's a zero-sum game). Also, there may be more to security in a complex app suite than security hotfixes. I'm asking the SF experts whether they consider the lower level of support provided during non-mainstream support to be a security risk. –  Argalatyr Jul 20 '09 at 1:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.