Microsoft's monthly Patch Tuesday focused entirely on Office, and most notably Excel, with four critical patches, including one that could allow a hacker to hijack a user's e-mail.

Of the 11 vulnerabilities contained in the four patches, nine of them addressed Excel, including a zero-day exploit that has been around since January. (Compare Patch and Vulnerability Management Products.) 

The Office patches, experts say, also present unique challenges for IT in that users have to have the original installation media to install the patches. That media could be on CD-rom, stored on the user’s hard drive or on a network share. Regardless, to install the patches, IT will have to make that media available for every desktop.

“Microsoft originally did that for license enforcement, but as we see vulnerabilities increase around Office it is something that is problematic for patching,” says Paul Zimski, senior director of market strategy at Lumension.

The problem could get worse as the SANS Institute listed “office productivity suites” as one of its Top 20 security risks in 2007. Microsoft Office dominates that category of software and critical vulnerabilities on the platform have risen from fewer than three in 2003 to nearly 24 in 2007, according to SANS.

In addition, Office is a major focal point of Microsoft’s software-plus-services initiative, especially as it relates to connecting users via collaboration.

While Excel contained the bulk of the flaws, the most serious issue may be MS08-015, which fixes a vulnerability that could allow a hacker to read existing e-mail on a user’s machine and hijack all subsequent e-mail.

The flaw works off a hyper link to an e-mail address. The link can appear on a Web page or within another e-mail. When the user clicks on the e-mail address link, they see a familiar operation – a new message opening on their desktop – but in the background code is simultaneously being executed on the user’s system.

In addition, the command used to open the mail message – called “MailTo” – can be hidden behind a regular looking Web page hyperlink in order to trick the user to click on the link. When the user clicks they would be confused to see a new mail message instead of a Web page, but the damage would already be done.