Re: security update not offered

[crosspost to Windows Update newsgroup]

See these recent, related threads in Windows Update newsgroup:

http://groups.google.com/group/micro...aa98988ac2859d

http://groups.google.com/group/micro...c035acad8ba1ac

We're still waiting for clarification from the Office team (outside of the
public newsgroups, that is). Personally, I believe both Secunia PSI and
"Patchlink (formerly Harrisstat)" are both wrong here and Windows Update is
right.

You'll find some heated discussions about this in the Secunia user forum,
too.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


Jo-Anne wrote:
> I posted most of the following on the PowerPoint newsgroup over a week
> ago,
> and the one person who responded didn't seem to know the answer, so I
> thought I'd try here.
>
> I have two WinXP computers, both fully updated through the Microsoft
> Update
> site and both with Microsoft Office Home & Student 2007, which includes
> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint viewer
> is
> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
> security
> issues with versions of the viewer prior to the one dated 3/28/09. My
> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08. According
> to
> the following Microsoft website, the current version is 12.0.6502.5000,
> dated 3/28/09:
> http://support.microsoft.com/kb/970059
>
> In theory, this version should have shown up on the Microsoft Updates
> site,
> but it isn't in my log of downloaded updates, and it isn't shown as
> available for downloading there. If it's necessary, I probably could
> download it from
>
> http://www.microsoft.com/downloads/d...displaylang=en
>
> Should I download that update? And if it's a security update, shouldn't it
> have appeared in Microsoft Updates?
>
> Thank you!
>
> Jo-Anne

Thank you, Robear! I guess I'll just wait to see what happens. One note,
however. Everything I saw at the websites you linked to referred to
PowerPoint 2003. I have PowerPoint 2007, and according to this Microsoft
webpage there is a security update for the PowerPoint 2007 viewer:

http://support.microsoft.com/default...b;en-us;970059

and one way to install it is through

http://update.microsoft.com/microsoftupdate/

but it's not there for my computers, although I seem to meet the
requirements: "You must have either 2007 Microsoft Office suite Service Pack
1 (SP1) or 2007 Microsoft Office Suite Service Pack 2 (SP2) installed to
apply this security update." UNLESS my Microsoft Office Home & Student
edition doesn't qualify, despite the fact that it too has PowerPoint 2007 as
part of it...

Thank you again!

Jo-Anne


"PA Bear [MS MVP]" <> wrote in message
news:...
> [crosspost to Windows Update newsgroup]
>
> See these recent, related threads in Windows Update newsgroup:
>
> http://groups.google.com/group/micro...aa98988ac2859d
>
> http://groups.google.com/group/micro...c035acad8ba1ac
>
> We're still waiting for clarification from the Office team (outside of the
> public newsgroups, that is). Personally, I believe both Secunia PSI and
> "Patchlink (formerly Harrisstat)" are both wrong here and Windows Update
> is
> right.
>
> You'll find some heated discussions about this in the Secunia user forum,
> too.
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Client - since 2002
>
>
> Jo-Anne wrote:
>> I posted most of the following on the PowerPoint newsgroup over a week
>> ago,
>> and the one person who responded didn't seem to know the answer, so I
>> thought I'd try here.
>>
>> I have two WinXP computers, both fully updated through the Microsoft
>> Update
>> site and both with Microsoft Office Home & Student 2007, which includes
>> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint viewer
>> is
>> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
>> security
>> issues with versions of the viewer prior to the one dated 3/28/09. My
>> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08. According
>> to
>> the following Microsoft website, the current version is 12.0.6502.5000,
>> dated 3/28/09:
>> http://support.microsoft.com/kb/970059
>>
>> In theory, this version should have shown up on the Microsoft Updates
>> site,
>> but it isn't in my log of downloaded updates, and it isn't shown as
>> available for downloading there. If it's necessary, I probably could
>> download it from
>>
>> http://www.microsoft.com/downloads/d...displaylang=en
>>
>> Should I download that update? And if it's a security update, shouldn't
>> it
>> have appeared in Microsoft Updates?
>>
>> Thank you!
>>
>> Jo-Anne
>

Jo-Anne wrote:

> Thank you, Robear! I guess I'll just wait to see what happens. One note,
> however. Everything I saw at the websites you linked to referred to
> PowerPoint 2003. I have PowerPoint 2007, and according to this Microsoft
> webpage there is a security update for the PowerPoint 2007 viewer:

Powerpoint Viewer and Powerpoint are different things, even though Powerpoint
includes the Powerpoint Viewer executable.

The Powerpoint update should have updated the viewer executable, but didn't.
Microsoft have said they will fix this, but there isn't an ETA at present.

Harry.

> http://support.microsoft.com/default...b;en-us;970059
>
> and one way to install it is through
>
> http://update.microsoft.com/microsoftupdate/
>
> but it's not there for my computers, although I seem to meet the
> requirements: "You must have either 2007 Microsoft Office suite Service Pack
> 1 (SP1) or 2007 Microsoft Office Suite Service Pack 2 (SP2) installed to
> apply this security update." UNLESS my Microsoft Office Home & Student
> edition doesn't qualify, despite the fact that it too has PowerPoint 2007 as
> part of it...
>
> Thank you again!
>
> Jo-Anne
>
>
> "PA Bear [MS MVP]" <> wrote in message
> news:...
>> [crosspost to Windows Update newsgroup]
>>
>> See these recent, related threads in Windows Update newsgroup:
>>
>> http://groups.google.com/group/micro...aa98988ac2859d
>>
>> http://groups.google.com/group/micro...c035acad8ba1ac
>>
>> We're still waiting for clarification from the Office team (outside of the
>> public newsgroups, that is). Personally, I believe both Secunia PSI and
>> "Patchlink (formerly Harrisstat)" are both wrong here and Windows Update
>> is
>> right.
>>
>> You'll find some heated discussions about this in the Secunia user forum,
>> too.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>
>>
>> Jo-Anne wrote:
>>> I posted most of the following on the PowerPoint newsgroup over a week
>>> ago,
>>> and the one person who responded didn't seem to know the answer, so I
>>> thought I'd try here.
>>>
>>> I have two WinXP computers, both fully updated through the Microsoft
>>> Update
>>> site and both with Microsoft Office Home & Student 2007, which includes
>>> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint viewer
>>> is
>>> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
>>> security
>>> issues with versions of the viewer prior to the one dated 3/28/09. My
>>> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08. According
>>> to
>>> the following Microsoft website, the current version is 12.0.6502.5000,
>>> dated 3/28/09:
>>> http://support.microsoft.com/kb/970059
>>>
>>> In theory, this version should have shown up on the Microsoft Updates
>>> site,
>>> but it isn't in my log of downloaded updates, and it isn't shown as
>>> available for downloading there. If it's necessary, I probably could
>>> download it from
>>>
>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>
>>> Should I download that update? And if it's a security update, shouldn't
>>> it
>>> have appeared in Microsoft Updates?
>>>
>>> Thank you!
>>>
>>> Jo-Anne
>
>

Thank you, Harry! I'm glad they've got it on the agenda.

Jo-Anne

"Harry Johnston [MVP]" <> wrote in message
news:...
> Jo-Anne wrote:
>
>> Thank you, Robear! I guess I'll just wait to see what happens. One note,
>> however. Everything I saw at the websites you linked to referred to
>> PowerPoint 2003. I have PowerPoint 2007, and according to this Microsoft
>> webpage there is a security update for the PowerPoint 2007 viewer:
>
> Powerpoint Viewer and Powerpoint are different things, even though
> Powerpoint includes the Powerpoint Viewer executable.
>
> The Powerpoint update should have updated the viewer executable, but
> didn't. Microsoft have said they will fix this, but there isn't an ETA at
> present.
>
> Harry.
>
>> http://support.microsoft.com/default...b;en-us;970059
>>
>> and one way to install it is through
>>
>> http://update.microsoft.com/microsoftupdate/
>>
>> but it's not there for my computers, although I seem to meet the
>> requirements: "You must have either 2007 Microsoft Office suite Service
>> Pack 1 (SP1) or 2007 Microsoft Office Suite Service Pack 2 (SP2)
>> installed to apply this security update." UNLESS my Microsoft Office Home
>> & Student edition doesn't qualify, despite the fact that it too has
>> PowerPoint 2007 as part of it...
>>
>> Thank you again!
>>
>> Jo-Anne
>>
>>
>> "PA Bear [MS MVP]" <> wrote in message
>> news:...
>>> [crosspost to Windows Update newsgroup]
>>>
>>> See these recent, related threads in Windows Update newsgroup:
>>>
>>> http://groups.google.com/group/micro...aa98988ac2859d
>>>
>>> http://groups.google.com/group/micro...c035acad8ba1ac
>>>
>>> We're still waiting for clarification from the Office team (outside of
>>> the
>>> public newsgroups, that is). Personally, I believe both Secunia PSI and
>>> "Patchlink (formerly Harrisstat)" are both wrong here and Windows Update
>>> is
>>> right.
>>>
>>> You'll find some heated discussions about this in the Secunia user
>>> forum,
>>> too.
>>> --
>>> ~Robear Dyer (PA Bear)
>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>>
>>>
>>> Jo-Anne wrote:
>>>> I posted most of the following on the PowerPoint newsgroup over a week
>>>> ago,
>>>> and the one person who responded didn't seem to know the answer, so I
>>>> thought I'd try here.
>>>>
>>>> I have two WinXP computers, both fully updated through the Microsoft
>>>> Update
>>>> site and both with Microsoft Office Home & Student 2007, which includes
>>>> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint
>>>> viewer
>>>> is
>>>> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
>>>> security
>>>> issues with versions of the viewer prior to the one dated 3/28/09. My
>>>> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08.
>>>> According
>>>> to
>>>> the following Microsoft website, the current version is 12.0.6502.5000,
>>>> dated 3/28/09:
>>>> http://support.microsoft.com/kb/970059
>>>>
>>>> In theory, this version should have shown up on the Microsoft Updates
>>>> site,
>>>> but it isn't in my log of downloaded updates, and it isn't shown as
>>>> available for downloading there. If it's necessary, I probably could
>>>> download it from
>>>>
>>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>>
>>>> Should I download that update? And if it's a security update, shouldn't
>>>> it
>>>> have appeared in Microsoft Updates?
>>>>
>>>> Thank you!
>>>>
>>>> Jo-Anne
>>

With all due respect to my distinguished colleague Harry Johnston...

Yes, that System Requirements description/warning is rather obtuse, isn't
it, and the whole MS09-017 issue is confusing (i.e., PowerPoint 2003 vs
PowerPoint Viewer 2003 vs PowerPoint 2007 vs PowerPoint Viewer 2007).

Short version for your case:

1a. Office Home & Student 2007 includes PowerPoint (POWERPNT.EXE), not
PowerPoint Viewer (PPTVIEW.EXE).

1b. If PowerPoint VIEWER 2007 is not listed in Add/Remove Programs, it's not
installed.

2. Your particular computer and installed Office applications only need
'Security Update for PowerPoint 2007 (KB957789)'. Since PowerPoint Viewer
2007 is not installed, Microsoft Update will not offer KB970059 and you will
not be able to install it manually.

More questions?...

Start a free Windows Update support incident request:
https://support.microsoft.com/oas/de...spx?gprid=6527

For home users, no-charge support is available by calling 1-866-PCSAFETY in
the United States and in Canada or by contacting your local Microsoft
subsidiary. There is no-charge for support calls that are associated with
security updates. When you call, clearly state that your problem is related
to a Security Update and cite the update's KB number (e.g., KB957789).
--
~PA Bear


Jo-Anne wrote:
> Thank you, Robear! I guess I'll just wait to see what happens. One note,
> however. Everything I saw at the websites you linked to referred to
> PowerPoint 2003. I have PowerPoint 2007, and according to this Microsoft
> webpage there is a security update for the PowerPoint 2007 viewer:
>
> http://support.microsoft.com/default...b;en-us;970059
>
> and one way to install it is through
>
> http://update.microsoft.com/microsoftupdate/
>
> but it's not there for my computers, although I seem to meet the
> requirements: "You must have either 2007 Microsoft Office suite Service
> Pack
> 1 (SP1) or 2007 Microsoft Office Suite Service Pack 2 (SP2) installed to
> apply this security update." UNLESS my Microsoft Office Home & Student
> edition doesn't qualify, despite the fact that it too has PowerPoint 2007
> as
> part of it...
>
> Thank you again!
>
> Jo-Anne
>
>
> "PA Bear [MS MVP]" <> wrote in message
> news:...
>> [crosspost to Windows Update newsgroup]
>>
>> See these recent, related threads in Windows Update newsgroup:
>>
>> http://groups.google.com/group/micro...aa98988ac2859d
>>
>> http://groups.google.com/group/micro...c035acad8ba1ac
>>
>> We're still waiting for clarification from the Office team (outside of
>> the
>> public newsgroups, that is). Personally, I believe both Secunia PSI and
>> "Patchlink (formerly Harrisstat)" are both wrong here and Windows Update
>> is
>> right.
>>
>> You'll find some heated discussions about this in the Secunia user forum,
>> too.
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>
>>
>> Jo-Anne wrote:
>>> I posted most of the following on the PowerPoint newsgroup over a week
>>> ago,
>>> and the one person who responded didn't seem to know the answer, so I
>>> thought I'd try here.
>>>
>>> I have two WinXP computers, both fully updated through the Microsoft
>>> Update
>>> site and both with Microsoft Office Home & Student 2007, which includes
>>> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint viewer
>>> is
>>> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
>>> security
>>> issues with versions of the viewer prior to the one dated 3/28/09. My
>>> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08. According
>>> to
>>> the following Microsoft website, the current version is 12.0.6502.5000,
>>> dated 3/28/09:
>>> http://support.microsoft.com/kb/970059
>>>
>>> In theory, this version should have shown up on the Microsoft Updates
>>> site,
>>> but it isn't in my log of downloaded updates, and it isn't shown as
>>> available for downloading there. If it's necessary, I probably could
>>> download it from
>>>
>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>
>>> Should I download that update? And if it's a security update, shouldn't
>>> it
>>> have appeared in Microsoft Updates?
>>>
>>> Thank you!
>>>
>>> Jo-Anne

Hi, Robear,

You might have missed something in my original post: "My PPTVIEW.EXE program
is version 12.0.6414.1000, dated 11/20/08."

The program appears in C:\Program Files\Microsoft Office\Office12. So
apparently it is included in Office Home & Student 2007. None of the
programs within Office appears in Add/Remove Programs by name; all it shows
is Microsoft Home and Student 2007 and the updates for each individual
program. I do have the PowerPoint security update you mentioned.

So...even more confusion!

Jo-Anne

"PA Bear [MS MVP]" <> wrote in message
news:...
> With all due respect to my distinguished colleague Harry Johnston...
>
> Yes, that System Requirements description/warning is rather obtuse, isn't
> it, and the whole MS09-017 issue is confusing (i.e., PowerPoint 2003 vs
> PowerPoint Viewer 2003 vs PowerPoint 2007 vs PowerPoint Viewer 2007).
>
> Short version for your case:
>
> 1a. Office Home & Student 2007 includes PowerPoint (POWERPNT.EXE), not
> PowerPoint Viewer (PPTVIEW.EXE).
>
> 1b. If PowerPoint VIEWER 2007 is not listed in Add/Remove Programs, it's
> not installed.
>
> 2. Your particular computer and installed Office applications only need
> 'Security Update for PowerPoint 2007 (KB957789)'. Since PowerPoint Viewer
> 2007 is not installed, Microsoft Update will not offer KB970059 and you
> will not be able to install it manually.
>
> More questions?...
>
> Start a free Windows Update support incident request:
> https://support.microsoft.com/oas/de...spx?gprid=6527
>
> For home users, no-charge support is available by calling 1-866-PCSAFETY
> in the United States and in Canada or by contacting your local Microsoft
> subsidiary. There is no-charge for support calls that are associated with
> security updates. When you call, clearly state that your problem is
> related to a Security Update and cite the update's KB number (e.g.,
> KB957789).
> --
> ~PA Bear
>
>
> Jo-Anne wrote:
>> Thank you, Robear! I guess I'll just wait to see what happens. One note,
>> however. Everything I saw at the websites you linked to referred to
>> PowerPoint 2003. I have PowerPoint 2007, and according to this Microsoft
>> webpage there is a security update for the PowerPoint 2007 viewer:
>>
>> http://support.microsoft.com/default...b;en-us;970059
>>
>> and one way to install it is through
>>
>> http://update.microsoft.com/microsoftupdate/
>>
>> but it's not there for my computers, although I seem to meet the
>> requirements: "You must have either 2007 Microsoft Office suite Service
>> Pack
>> 1 (SP1) or 2007 Microsoft Office Suite Service Pack 2 (SP2) installed to
>> apply this security update." UNLESS my Microsoft Office Home & Student
>> edition doesn't qualify, despite the fact that it too has PowerPoint 2007
>> as
>> part of it...
>>
>> Thank you again!
>>
>> Jo-Anne
>>
>>
>> "PA Bear [MS MVP]" <> wrote in message
>> news:...
>>> [crosspost to Windows Update newsgroup]
>>>
>>> See these recent, related threads in Windows Update newsgroup:
>>>
>>> http://groups.google.com/group/micro...aa98988ac2859d
>>>
>>> http://groups.google.com/group/micro...c035acad8ba1ac
>>>
>>> We're still waiting for clarification from the Office team (outside of
>>> the
>>> public newsgroups, that is). Personally, I believe both Secunia PSI and
>>> "Patchlink (formerly Harrisstat)" are both wrong here and Windows Update
>>> is
>>> right.
>>>
>>> You'll find some heated discussions about this in the Secunia user
>>> forum,
>>> too.
>>> --
>>> ~Robear Dyer (PA Bear)
>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>>
>>>
>>> Jo-Anne wrote:
>>>> I posted most of the following on the PowerPoint newsgroup over a week
>>>> ago,
>>>> and the one person who responded didn't seem to know the answer, so I
>>>> thought I'd try here.
>>>>
>>>> I have two WinXP computers, both fully updated through the Microsoft
>>>> Update
>>>> site and both with Microsoft Office Home & Student 2007, which includes
>>>> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint
>>>> viewer
>>>> is
>>>> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
>>>> security
>>>> issues with versions of the viewer prior to the one dated 3/28/09. My
>>>> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08.
>>>> According
>>>> to
>>>> the following Microsoft website, the current version is 12.0.6502.5000,
>>>> dated 3/28/09:
>>>> http://support.microsoft.com/kb/970059
>>>>
>>>> In theory, this version should have shown up on the Microsoft Updates
>>>> site,
>>>> but it isn't in my log of downloaded updates, and it isn't shown as
>>>> available for downloading there. If it's necessary, I probably could
>>>> download it from
>>>>
>>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>>
>>>> Should I download that update? And if it's a security update, shouldn't
>>>> it
>>>> have appeared in Microsoft Updates?
>>>>
>>>> Thank you!
>>>>
>>>> Jo-Anne
>

"PA Bear [MS MVP]" <> wrote:

> With all due respect to my distinguished colleague Harry Johnston...
>
> Yes, that System Requirements description/warning is rather obtuse, isn't
> it, and the whole MS09-017 issue is confusing (i.e., PowerPoint 2003 vs
> PowerPoint Viewer 2003 vs PowerPoint 2007 vs PowerPoint Viewer 2007).
>
> Short version for your case:
>
> 1a. Office Home & Student 2007 includes PowerPoint (POWERPNT.EXE), not
> PowerPoint Viewer (PPTVIEW.EXE).

That's (again) wrong: Office 2007 includes the PPT Viewer 2007!

Stefan

Open a free Support Incident, Jo-Anne.

Jo-Anne wrote:
> Hi, Robear,
>
> You might have missed something in my original post: "My PPTVIEW.EXE
> program
> is version 12.0.6414.1000, dated 11/20/08."
>
> The program appears in C:\Program Files\Microsoft Office\Office12. So
> apparently it is included in Office Home & Student 2007. None of the
> programs within Office appears in Add/Remove Programs by name; all it
> shows
> is Microsoft Home and Student 2007 and the updates for each individual
> program. I do have the PowerPoint security update you mentioned.
>
> So...even more confusion!
>
> Jo-Anne
>
> "PA Bear [MS MVP]" <> wrote in message
> news:...
>> With all due respect to my distinguished colleague Harry Johnston...
>>
>> Yes, that System Requirements description/warning is rather obtuse, isn't
>> it, and the whole MS09-017 issue is confusing (i.e., PowerPoint 2003 vs
>> PowerPoint Viewer 2003 vs PowerPoint 2007 vs PowerPoint Viewer 2007).
>>
>> Short version for your case:
>>
>> 1a. Office Home & Student 2007 includes PowerPoint (POWERPNT.EXE), not
>> PowerPoint Viewer (PPTVIEW.EXE).
>>
>> 1b. If PowerPoint VIEWER 2007 is not listed in Add/Remove Programs, it's
>> not installed.
>>
>> 2. Your particular computer and installed Office applications only need
>> 'Security Update for PowerPoint 2007 (KB957789)'. Since PowerPoint
>> Viewer
>> 2007 is not installed, Microsoft Update will not offer KB970059 and you
>> will not be able to install it manually.
>>
>> More questions?...
>>
>> Start a free Windows Update support incident request:
>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>
>> For home users, no-charge support is available by calling 1-866-PCSAFETY
>> in the United States and in Canada or by contacting your local Microsoft
>> subsidiary. There is no-charge for support calls that are associated
>> with
>> security updates. When you call, clearly state that your problem is
>> related to a Security Update and cite the update's KB number (e.g.,
>> KB957789).
>> --
>> ~PA Bear
>>
>>
>> Jo-Anne wrote:
>>> Thank you, Robear! I guess I'll just wait to see what happens. One note,
>>> however. Everything I saw at the websites you linked to referred to
>>> PowerPoint 2003. I have PowerPoint 2007, and according to this Microsoft
>>> webpage there is a security update for the PowerPoint 2007 viewer:
>>>
>>> http://support.microsoft.com/default...b;en-us;970059
>>>
>>> and one way to install it is through
>>>
>>> http://update.microsoft.com/microsoftupdate/
>>>
>>> but it's not there for my computers, although I seem to meet the
>>> requirements: "You must have either 2007 Microsoft Office suite Service
>>> Pack
>>> 1 (SP1) or 2007 Microsoft Office Suite Service Pack 2 (SP2) installed to
>>> apply this security update." UNLESS my Microsoft Office Home & Student
>>> edition doesn't qualify, despite the fact that it too has PowerPoint
>>> 2007
>>> as
>>> part of it...
>>>
>>> Thank you again!
>>>
>>> Jo-Anne
>>>
>>>
>>> "PA Bear [MS MVP]" <> wrote in message
>>> news:...
>>>> [crosspost to Windows Update newsgroup]
>>>>
>>>> See these recent, related threads in Windows Update newsgroup:
>>>>
>>>> http://groups.google.com/group/micro...aa98988ac2859d
>>>>
>>>> http://groups.google.com/group/micro...c035acad8ba1ac
>>>>
>>>> We're still waiting for clarification from the Office team (outside of
>>>> the
>>>> public newsgroups, that is). Personally, I believe both Secunia PSI
>>>> and
>>>> "Patchlink (formerly Harrisstat)" are both wrong here and Windows
>>>> Update
>>>> is
>>>> right.
>>>>
>>>> You'll find some heated discussions about this in the Secunia user
>>>> forum,
>>>> too.
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>>>
>>>>
>>>> Jo-Anne wrote:
>>>>> I posted most of the following on the PowerPoint newsgroup over a week
>>>>> ago,
>>>>> and the one person who responded didn't seem to know the answer, so I
>>>>> thought I'd try here.
>>>>>
>>>>> I have two WinXP computers, both fully updated through the Microsoft
>>>>> Update
>>>>> site and both with Microsoft Office Home & Student 2007, which
>>>>> includes
>>>>> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint
>>>>> viewer
>>>>> is
>>>>> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
>>>>> security
>>>>> issues with versions of the viewer prior to the one dated 3/28/09. My
>>>>> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08.
>>>>> According
>>>>> to
>>>>> the following Microsoft website, the current version is
>>>>> 12.0.6502.5000,
>>>>> dated 3/28/09:
>>>>> http://support.microsoft.com/kb/970059
>>>>>
>>>>> In theory, this version should have shown up on the Microsoft Updates
>>>>> site,
>>>>> but it isn't in my log of downloaded updates, and it isn't shown as
>>>>> available for downloading there. If it's necessary, I probably could
>>>>> download it from
>>>>>
>>>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>>>
>>>>> Should I download that update? And if it's a security update,
>>>>> shouldn't
>>>>> it
>>>>> have appeared in Microsoft Updates?
>>>>>
>>>>> Thank you!
>>>>>
>>>>> Jo-Anne

So I shouldn't just wait til Microsoft catches up, as Harry suggested it
would?

"PA Bear [MS MVP]" <> wrote in message
news:...
> Open a free Support Incident, Jo-Anne.
>
> Jo-Anne wrote:
>> Hi, Robear,
>>
>> You might have missed something in my original post: "My PPTVIEW.EXE
>> program
>> is version 12.0.6414.1000, dated 11/20/08."
>>
>> The program appears in C:\Program Files\Microsoft Office\Office12. So
>> apparently it is included in Office Home & Student 2007. None of the
>> programs within Office appears in Add/Remove Programs by name; all it
>> shows
>> is Microsoft Home and Student 2007 and the updates for each individual
>> program. I do have the PowerPoint security update you mentioned.
>>
>> So...even more confusion!
>>
>> Jo-Anne
>>
>> "PA Bear [MS MVP]" <> wrote in message
>> news:...
>>> With all due respect to my distinguished colleague Harry Johnston...
>>>
>>> Yes, that System Requirements description/warning is rather obtuse,
>>> isn't
>>> it, and the whole MS09-017 issue is confusing (i.e., PowerPoint 2003 vs
>>> PowerPoint Viewer 2003 vs PowerPoint 2007 vs PowerPoint Viewer 2007).
>>>
>>> Short version for your case:
>>>
>>> 1a. Office Home & Student 2007 includes PowerPoint (POWERPNT.EXE), not
>>> PowerPoint Viewer (PPTVIEW.EXE).
>>>
>>> 1b. If PowerPoint VIEWER 2007 is not listed in Add/Remove Programs, it's
>>> not installed.
>>>
>>> 2. Your particular computer and installed Office applications only need
>>> 'Security Update for PowerPoint 2007 (KB957789)'. Since PowerPoint
>>> Viewer
>>> 2007 is not installed, Microsoft Update will not offer KB970059 and you
>>> will not be able to install it manually.
>>>
>>> More questions?...
>>>
>>> Start a free Windows Update support incident request:
>>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>>
>>> For home users, no-charge support is available by calling 1-866-PCSAFETY
>>> in the United States and in Canada or by contacting your local Microsoft
>>> subsidiary. There is no-charge for support calls that are associated
>>> with
>>> security updates. When you call, clearly state that your problem is
>>> related to a Security Update and cite the update's KB number (e.g.,
>>> KB957789).
>>> --
>>> ~PA Bear
>>>
>>>
>>> Jo-Anne wrote:
>>>> Thank you, Robear! I guess I'll just wait to see what happens. One
>>>> note,
>>>> however. Everything I saw at the websites you linked to referred to
>>>> PowerPoint 2003. I have PowerPoint 2007, and according to this
>>>> Microsoft
>>>> webpage there is a security update for the PowerPoint 2007 viewer:
>>>>
>>>> http://support.microsoft.com/default...b;en-us;970059
>>>>
>>>> and one way to install it is through
>>>>
>>>> http://update.microsoft.com/microsoftupdate/
>>>>
>>>> but it's not there for my computers, although I seem to meet the
>>>> requirements: "You must have either 2007 Microsoft Office suite Service
>>>> Pack
>>>> 1 (SP1) or 2007 Microsoft Office Suite Service Pack 2 (SP2) installed
>>>> to
>>>> apply this security update." UNLESS my Microsoft Office Home & Student
>>>> edition doesn't qualify, despite the fact that it too has PowerPoint
>>>> 2007
>>>> as
>>>> part of it...
>>>>
>>>> Thank you again!
>>>>
>>>> Jo-Anne
>>>>
>>>>
>>>> "PA Bear [MS MVP]" <> wrote in message
>>>> news:...
>>>>> [crosspost to Windows Update newsgroup]
>>>>>
>>>>> See these recent, related threads in Windows Update newsgroup:
>>>>>
>>>>> http://groups.google.com/group/micro...aa98988ac2859d
>>>>>
>>>>> http://groups.google.com/group/micro...c035acad8ba1ac
>>>>>
>>>>> We're still waiting for clarification from the Office team (outside of
>>>>> the
>>>>> public newsgroups, that is). Personally, I believe both Secunia PSI
>>>>> and
>>>>> "Patchlink (formerly Harrisstat)" are both wrong here and Windows
>>>>> Update
>>>>> is
>>>>> right.
>>>>>
>>>>> You'll find some heated discussions about this in the Secunia user
>>>>> forum,
>>>>> too.
>>>>> --
>>>>> ~Robear Dyer (PA Bear)
>>>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>>>>
>>>>>
>>>>> Jo-Anne wrote:
>>>>>> I posted most of the following on the PowerPoint newsgroup over a
>>>>>> week
>>>>>> ago,
>>>>>> and the one person who responded didn't seem to know the answer, so I
>>>>>> thought I'd try here.
>>>>>>
>>>>>> I have two WinXP computers, both fully updated through the Microsoft
>>>>>> Update
>>>>>> site and both with Microsoft Office Home & Student 2007, which
>>>>>> includes
>>>>>> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint
>>>>>> viewer
>>>>>> is
>>>>>> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
>>>>>> security
>>>>>> issues with versions of the viewer prior to the one dated 3/28/09. My
>>>>>> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08.
>>>>>> According
>>>>>> to
>>>>>> the following Microsoft website, the current version is
>>>>>> 12.0.6502.5000,
>>>>>> dated 3/28/09:
>>>>>> http://support.microsoft.com/kb/970059
>>>>>>
>>>>>> In theory, this version should have shown up on the Microsoft Updates
>>>>>> site,
>>>>>> but it isn't in my log of downloaded updates, and it isn't shown as
>>>>>> available for downloading there. If it's necessary, I probably could
>>>>>> download it from
>>>>>>
>>>>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>>>>
>>>>>> Should I download that update? And if it's a security update,
>>>>>> shouldn't
>>>>>> it
>>>>>> have appeared in Microsoft Updates?
>>>>>>
>>>>>> Thank you!
>>>>>>
>>>>>> Jo-Anne
>

Jo-Anne wrote:

> Hi, Robear,
>
> You might have missed something in my original post: "My PPTVIEW.EXE program
> is version 12.0.6414.1000, dated 11/20/08."
>
> The program appears in C:\Program Files\Microsoft Office\Office12. So
> apparently it is included in Office Home & Student 2007. [...]

Susan Bradley has also been looking into this, and from what she has discovered
it is my understanding that pptview.exe is present in Office 2007 because
there's a function in Powerpoint that packages pptview.exe together with your
Powerpoint document for distribution to people who might not already have the
Powerpoint viewer. (I may have some of the details wrong, but that's the
general picture.)

From what I was told, it may be theoretically possible for an attacker to get a
Powerpoint document to open with pptview.exe instead of powerpnt.exe, although
it would be difficult. I'm doubtful that there is any real risk, but if you are
concerned, renaming pptview.exe to pptview.old will eliminate it. So long as
you don't need the packaging function I mention above, there shouldn't be any
side effects.

Harry.




> None of the
> programs within Office appears in Add/Remove Programs by name; all it shows
> is Microsoft Home and Student 2007 and the updates for each individual
> program. I do have the PowerPoint security update you mentioned.
>
> So...even more confusion!
>
> Jo-Anne
>
> "PA Bear [MS MVP]" <> wrote in message
> news:...
>> With all due respect to my distinguished colleague Harry Johnston...
>>
>> Yes, that System Requirements description/warning is rather obtuse, isn't
>> it, and the whole MS09-017 issue is confusing (i.e., PowerPoint 2003 vs
>> PowerPoint Viewer 2003 vs PowerPoint 2007 vs PowerPoint Viewer 2007).
>>
>> Short version for your case:
>>
>> 1a. Office Home & Student 2007 includes PowerPoint (POWERPNT.EXE), not
>> PowerPoint Viewer (PPTVIEW.EXE).
>>
>> 1b. If PowerPoint VIEWER 2007 is not listed in Add/Remove Programs, it's
>> not installed.
>>
>> 2. Your particular computer and installed Office applications only need
>> 'Security Update for PowerPoint 2007 (KB957789)'. Since PowerPoint Viewer
>> 2007 is not installed, Microsoft Update will not offer KB970059 and you
>> will not be able to install it manually.
>>
>> More questions?...
>>
>> Start a free Windows Update support incident request:
>> https://support.microsoft.com/oas/de...spx?gprid=6527
>>
>> For home users, no-charge support is available by calling 1-866-PCSAFETY
>> in the United States and in Canada or by contacting your local Microsoft
>> subsidiary. There is no-charge for support calls that are associated with
>> security updates. When you call, clearly state that your problem is
>> related to a Security Update and cite the update's KB number (e.g.,
>> KB957789).
>> --
>> ~PA Bear
>>
>>
>> Jo-Anne wrote:
>>> Thank you, Robear! I guess I'll just wait to see what happens. One note,
>>> however. Everything I saw at the websites you linked to referred to
>>> PowerPoint 2003. I have PowerPoint 2007, and according to this Microsoft
>>> webpage there is a security update for the PowerPoint 2007 viewer:
>>>
>>> http://support.microsoft.com/default...b;en-us;970059
>>>
>>> and one way to install it is through
>>>
>>> http://update.microsoft.com/microsoftupdate/
>>>
>>> but it's not there for my computers, although I seem to meet the
>>> requirements: "You must have either 2007 Microsoft Office suite Service
>>> Pack
>>> 1 (SP1) or 2007 Microsoft Office Suite Service Pack 2 (SP2) installed to
>>> apply this security update." UNLESS my Microsoft Office Home & Student
>>> edition doesn't qualify, despite the fact that it too has PowerPoint 2007
>>> as
>>> part of it...
>>>
>>> Thank you again!
>>>
>>> Jo-Anne
>>>
>>>
>>> "PA Bear [MS MVP]" <> wrote in message
>>> news:...
>>>> [crosspost to Windows Update newsgroup]
>>>>
>>>> See these recent, related threads in Windows Update newsgroup:
>>>>
>>>> http://groups.google.com/group/micro...aa98988ac2859d
>>>>
>>>> http://groups.google.com/group/micro...c035acad8ba1ac
>>>>
>>>> We're still waiting for clarification from the Office team (outside of
>>>> the
>>>> public newsgroups, that is). Personally, I believe both Secunia PSI and
>>>> "Patchlink (formerly Harrisstat)" are both wrong here and Windows Update
>>>> is
>>>> right.
>>>>
>>>> You'll find some heated discussions about this in the Secunia user
>>>> forum,
>>>> too.
>>>> --
>>>> ~Robear Dyer (PA Bear)
>>>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>>>
>>>>
>>>> Jo-Anne wrote:
>>>>> I posted most of the following on the PowerPoint newsgroup over a week
>>>>> ago,
>>>>> and the one person who responded didn't seem to know the answer, so I
>>>>> thought I'd try here.
>>>>>
>>>>> I have two WinXP computers, both fully updated through the Microsoft
>>>>> Update
>>>>> site and both with Microsoft Office Home & Student 2007, which includes
>>>>> PowerPoint. Recently, Secunia PSI informed me that the PowerPoint
>>>>> viewer
>>>>> is
>>>>> insecure. The Windows Secrets newsletter of 5/14/09 also discussed
>>>>> security
>>>>> issues with versions of the viewer prior to the one dated 3/28/09. My
>>>>> PPTVIEW.EXE program is version 12.0.6414.1000, dated 11/20/08.
>>>>> According
>>>>> to
>>>>> the following Microsoft website, the current version is 12.0.6502.5000,
>>>>> dated 3/28/09:
>>>>> http://support.microsoft.com/kb/970059
>>>>>
>>>>> In theory, this version should have shown up on the Microsoft Updates
>>>>> site,
>>>>> but it isn't in my log of downloaded updates, and it isn't shown as
>>>>> available for downloading there. If it's necessary, I probably could
>>>>> download it from
>>>>>
>>>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>>>
>>>>> Should I download that update? And if it's a security update, shouldn't
>>>>> it
>>>>> have appeared in Microsoft Updates?
>>>>>
>>>>> Thank you!
>>>>>
>>>>> Jo-Anne
>
>