3

I am significantly displeased with some of the newer versions of Microsoft Outlook. I would prefer to continue using my older version from Office 2000 (on Windows 7 using workarounds). As a networked application which is no longer being updated by Microsoft, is it critical to update this application to the latest version of Outlook 2016?

I am curious because I intend to continue using the rest of Office 2000 (Word, Excel, etc.) alongside firewall rules which prevent internet access. (If you think this is also a bad idea, please detail why). Obviously, Outlook will have to communicate over Port 25 to the mail server, what kind of threats will I face from unknown senders that won't be a problem in Outlook 2016... most email security seems to center on safe reading habits. However, I have looked through some Outlook CVE's and its quite clear there are numerous exploits which "could allow a remote attacker to run arbitrary code..." on both older versions and new.

  • Are you going to open any file not created by you? (that you were sent, that was downloaded from the internet...) Even if Office itself can't access to the internet, the document could ran a malicious executable that for instance deleted your documents. – Ángel Mar 21 '16 at 22:33
  • 1
    To summarize @HansKristian's more complete answer below: you should assume Office 2000 to be entirely compromised and unsuitable for any purpose requiring any security at all. – msw Mar 21 '16 at 22:59
  • Instead of using Office 2000 suite, perhaps libreoffice suits your needs. It has a "traditional" interface and unlike Office 2000, it is supported, instead of having unpatched security vulnerabilities. Plus, you don't need to pay licenses for using it. – Ángel Mar 22 '16 at 13:10
2

What kind of threats will I face from unknown senders that won't be a problem in Outlook 2016

Outlook 2000 is vulnerable to known attacks, but the key difference compared to 2016 is that there is no effort from Microsoft to close the Outlook 2000 vulnerabilities. Any bugs that are found now that support is dropped, will not be patched, so there can only become more known vulnerabilities as time passes.

Most email security seems to center on safe reading habits.

Take CVE-2006-1305. The attack was conducted with malformed email headers. This attack would trigger when the message is downloaded from the server, and thus be underway before you decide to open the message or not.

I intend to continue using the rest of Office 2000 (Word, Excel, etc.) alongside firewall rules which prevent internet access.

While your firewall might stop the applications themselves from contacting the internet, there is nothing stopping an attack from using a different program to connect to the internet. A macro included in a document might instruct information to be copied to a shared folder on disk, or it could open some other program, for example a spyware application.

In short, running unpatched and unsupported software is a very bad idea, and should be avoided as long as the system is connected to the internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.