Security Updates for Microsoft Office Products C2R

Overview

This documentation provides detailed information about security updates for Microsoft Office Products deployed through Click-to-Run (C2R). Regular updates are essential for addressing security vulnerabilities that may affect various Office applications, including Word, Excel, PowerPoint, and Outlook.

• Severity: Variable (Dependent on the specific vulnerabilities addressed)

Impact

Not applying security updates to Microsoft Office products can lead to several risks, including:

• Remote Code Execution: Exploits that allow attackers to run arbitrary code remotely through crafted documents.
• Data Breach: Vulnerabilities that could lead to unauthorized data access.
• System Compromise: Potential for a compromised system if vulnerabilities are exploited.

Cause

Security vulnerabilities in Office products can arise from:

• Inadequate input validation.
• Improper handling of objects in memory.
• Flaws in document parsing.

Solution

To ensure the security of Microsoft Office applications, it is critical to apply the latest updates provided by Microsoft for products installed via the C2R technology.

1. Enable Automatic Updates:
   • For Office applications using C2R, updates are typically delivered automatically. Ensure that automatic updates are enabled by going to any Office application:
     • File > Account > Update Options > Enable Updates.
2. Manual Check for Updates:
   • If automatic updates are not feasible or if immediate patching is required, manually check for updates: File > Account > Update Options > Update Now.
3. Configuration via Group Policy:
   • For enterprise environments, configure Office updates via Group Policy to automate and manage updates centrally.

Examples

Script to Force Check for Updates: For environments where immediate application of updates is necessary, use a script to force an update check:

$ospp = "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"
Start-Process -FilePath $ospp -ArgumentList "/update USER displaylevel=False forceappshutdown=True"

References

N/A

Additional Resources

• How to update Microsoft Office 365
• Choose how to deliver updates