3

I am significantly displeased with some of the newer versions of Microsoft Outlook. I would prefer to continue using my older version from Office 2000 (on Windows 7 using workarounds). As a networked application which is no longer being updated by Microsoft, is it critical to update this application to the latest version of Outlook 2016?

I am curious because I intend to continue using the rest of Office 2000 (Word, Excel, etc.) alongside firewall rules which prevent internet access. (If you think this is also a bad idea, please detail why). Obviously, Outlook will have to communicate over Port 25 to the mail server, what kind of threats will I face from unknown senders that won't be a problem in Outlook 2016... most email security seems to center on safe reading habits. However, I have looked through some Outlook CVE's and its quite clear there are numerous exploits which "could allow a remote attacker to run arbitrary code..." on both older versions and new.

Improve this question
3
  • Are you going to open any file not created by you? (that you were sent, that was downloaded from the internet...) Even if Office itself can't access to the internet, the document could ran a malicious executable that for instance deleted your documents.
    – Ángel
    Mar 21, 2016 at 22:33
  • 1
    To summarize @HansKristian's more complete answer below: you should assume Office 2000 to be entirely compromised and unsuitable for any purpose requiring any security at all.
    – msw
    Mar 21, 2016 at 22:59
  • Instead of using Office 2000 suite, perhaps libreoffice suits your needs. It has a "traditional" interface and unlike Office 2000, it is supported, instead of having unpatched security vulnerabilities. Plus, you don't need to pay licenses for using it.
    – Ángel
    Mar 22, 2016 at 13:10

1 Answer 1

Reset to default
2

What kind of threats will I face from unknown senders that won't be a problem in Outlook 2016

Outlook 2000 is vulnerable to known attacks, but the key difference compared to 2016 is that there is no effort from Microsoft to close the Outlook 2000 vulnerabilities. Any bugs that are found now that support is dropped, will not be patched, so there can only become more known vulnerabilities as time passes.

Most email security seems to center on safe reading habits.

Take CVE-2006-1305. The attack was conducted with malformed email headers. This attack would trigger when the message is downloaded from the server, and thus be underway before you decide to open the message or not.

I intend to continue using the rest of Office 2000 (Word, Excel, etc.) alongside firewall rules which prevent internet access.

While your firewall might stop the applications themselves from contacting the internet, there is nothing stopping an attack from using a different program to connect to the internet. A macro included in a document might instruct information to be copied to a shared folder on disk, or it could open some other program, for example a spyware application.

In short, running unpatched and unsupported software is a very bad idea, and should be avoided as long as the system is connected to the internet.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .