Office 2003 to get security upgrade

Service Pack 3 for Office 2003 will be focused on security, said Joshua Edwards, a technical product manager for Office at Microsoft. "We're trying to take what we learned from building Office 2007 and bring as much as we can to Office 2003," Edwards said in an interview with CNET News.com.

Microsoft hasn't yet set a release date for the Office 2003 update, which like other service packs will be available as a free upgrade. Also, there are no details of what will be in the update, other than that Microsoft is "backporting" work it did for Office 2007.

"We're not going to take everything, but we will take as much as we can," said Edwards, discussing what might be in the update.

Many of the changes will be invisible to users, hardening the applications and file parsers against attacks, Edwards said. Such changes under the hood could help protect against attacks that exploit security vulnerabilities in Office applications. Such attacks appear to be on the rise, in particular where specific organizations are targeted.

However, some user features may also make it to the older version, including the ability to select a preferred encryption mechanism. For example, in Office 2007 it is possible to replace the standard AES encryption with another, such as Suite B, which is a feature the U.S. government requested, Edwards said.

The last service pack for Office 2003 was released in September 2005 and also was aimed at beefing up security, enhancing application stability and adding support for Microsoft SQL Server 2005 and Microsoft Visual Studio 2005.

Office 2007 became broadly available earlier this year. Major changes include new file formats and a radically revised user interface. Microsoft also combined security features in a new "Trust Center" interface. So far at least one apparently serious security bug in Office 2007 has been reported.