Microsoft leaves Mac Office users in the lurch, says researcher

Again omits a Mac PowerPoint patch that it provided Windows customers

Microsoft yesterday told Mac Office users it doesn't yet have a fix for a PowerPoint bug that it patched for Windows customers.

"Security updates for Microsoft Office 2004 for Mac, Microsoft Office 2008 for Mac, and Open XML File Format Converter for Mac are unavailable at this time," the company's MS11-036 security bulletin said. "Microsoft will issue updates for these software when testing is complete, to ensure a high degree of quality for their release."

MS11-036 was part of May's two-update Patch Tuesday, and closed a pair of holes rated "important" in PowerPoint 2002, 2003 and 2007 on Windows. Only one of the two bugs affects Office for Mac 2004 and Office for Mac 2008.

The newest versions, Office 2010 on Windows and Office for Mac 2011, do not contain the vulnerabilities.

Tuesday was not the first time that Microsoft has released fixes for Office on Windows without corresponding patches for Mac users.

Last November, Microsoft patched four flaws in PowerPoint on the Windows platform, but omitted fixes for the same bugs in the presentation manager included with Office for Mac 2004 and Office for Mac 2008.

Microsoft released patches for Office for Mac 2008 five weeks later, but did not patch Office for Mac 2004 until mid-April 2011, five months after Windows users received their updates.

On Wednesday, a Microsoft's spokesman declined to spell out a timetable for May's missing Mac patch, saying only that the company is working on a fix.

According to MS11-036, attackers can hijack a Windows PC or Mac by convincing victims to open a malformed PowerPoint file, perhaps one attached to an email message or available for viewing and downloading from a malicious Web site.

In similar incidents in the past -- not only in November 2010 but also in May 2009 -- Microsoft has defended the decision to roll out an update minus Mac patches.

Last November, Jerry Bryant, a group manager with the Microsoft Security Response Center (MSRC), said it was a matter of priorities. "Normally, we release updates for all affected products at the same time, [but] in cases where the vast majority of our customers are at potential risk and we can provide protections, we may decide to release updates for those products, if ready, ahead of products where the risk is very low," Bryant said at the time.

Bryant was not available for comment today about May's decision.

Security researchers chided Microsoft for what one described as leaving Mac users "in the lurch."

"The risk is that cybercriminals will reverse engineer the fix for the Windows version of PowerPoint, and use the information they discover to exploit the vulnerability on Mac versions," argued Graham Cluley, senior security technology consultant at U.K.-based antivirus vendor Sophos, in a post to a his company's blog. "Once again, Mac users are being left in the lurch and have to cross their fingers that malicious hackers don't attempt to exploit the vulnerability."

Andrew Storms, director of security operations at nCircle Security, disagreed.

"I do think it's unfortunate that the older Mac versions aren't getting the fix at the same rate as the other versions [but] I don't see a huge risk at the moment," said Storms. "I really don't see a ton of attackers suddenly changing direction to go after the older Mac Office products."

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed. His e-mail address is gkeizer@computerworld.com.

Read more about security in Computerworld's Security Topic Center.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Mac OSMicrosoftsecuritysoftwareMalware and Vulnerabilitiesoperating systems

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?