Guide to the Secure Configuration and Administration of Microsoft ...

what is defined as “Level 2” attachments in a different manner. Level 2 files are
not blocked, but instead the user is required to save them to the hard disk before
executing. This is intended to cause the user to pause before acting and not just
absent-mindedly launch a potentially malicious attachment. By default, no file
types are included in Level 2; however, the administrator can, in some cases,
define the files types that should be included in Level 2 as well as modify the file
types defined as Level 1. These modifications can only be made in instances
where the user is connecting to an Exchange server and is not using .pst files for
mail storage. The patch also controls access to the Outlook address book as a
countermeasure against malicious code that replicates by auto-forwarding itself
to a user’s contacts and provides protection against malicious embedded objects
and scripts. A complete description and installation instructions are provided at
the office update URL.
Cdoup98.exe. In addition to using the Outlook object model to access the
Outlook address book, a malicious program could also use Outlook Collaborative
Data Objects (CDO). While O98secu.exe removes CDO from Outlook 98, this
may be a feature that internal applications rely upon. If it is desired to reinstate
CDO, use cdoup98.exe http://office.microsoft.com/downloads/9798/
Cdoup98.aspx
At the time of this writing, Microsoft had released the several security relevant
patches or hot fixes for Outlook. It is recommended to review the security
bulletins at http://www.microsoft.com/technet/security/current.asp for the latest
information. It is critical to install security related fixes as soon as possible.
It is also important to apply the latest patches to Internet Explorer. Some attacks,
such as the BubbleBoy virus, use mail messages sent to an Outlook client to
launch exploits against Internet Explorer vulnerabilities. It is recommended to
review the security bulletins at
http://www.microsoft.com/technet/security/current.asp for the latest information.
It is critical to install security related fixes as soon as possible.
Install the client to a partition other than where the operating system is located.
Post Installation
After installation is completed, the following permissions are recommended for the
directories where the client is installed. Note that some of these recommendations reflect
minor changes to the permissions invoked by the “Guide to Secure Microsoft Windows
NT Networks” and are necessary for the Exchange environment to function properly.
The following permissions related to the clients are recommended:
For the directory where the client was installed, apply the following permissions to all
subdirectories and files:
Authenticated Users: Modify
CREATOR OWNER: Full Control
10