Patch Tuesday bugs appearing already – after installing today’s Office patches, you may trigger a VBA “Compile error: Can’t find project or library”

Topic

New Reply

Official confirmation here: When you install one of the Microsoft Office security updates that are listed in Microsoft Common Vulnerabilities and Expo
[See the full post at: Patch Tuesday bugs appearing already – after installing today’s Office patches, you may trigger a VBA “Compile error: Can’t find project or library”]

3 users thanked author for this post.

rontpxz81, Elly, abbodi86

Reply | Quote

Replies

[Susan Bradley]

IMHO that’s an announced bug which translates to “you need to contact your line of business vendor and deal with the issue because we’re not fixing this as we intend to protect you from this vulnerability”.  You know what I mean?  So if anyone hits this, my advice would be to reach out to their line of business vendor and ask them if they would recommend the workaround or are there plans to make other adjustments on the vendor’s side.  In other words, do a test.  Check your line of business apps and make sure you are okay.

Susan Bradley Patch Lady/Prudent patcher

• This reply was modified 5 years, 2 months ago by Susan Bradley.

5 users thanked author for this post.

NetDef, Bob Blumenfeld, fk5353, Elly, woody

Reply | Quote

I don’t see any official workaround…

Any idea which vendor might be in the crosshairs?

Reply | Quote

A workaround is in the “official acknowledgement” that you posted the link for; but is only recommended for intranet locations, not internet locations:

What should I do to unblock VBA object libraries?

Internet VBA object libraries: We recommend that you block these because they are vulnerable.

Intranet VBA object libraries: You can enable these through a GPO setting, as shown in the following image. The setting is located under User Configuration > Administrative Templates > Microsoft Office 2016 > Security Settings.

The blocking/error only occurs for untrusted sites as indicated there.

1 user thanked author for this post.

NetDef

Reply | Quote

IMHO, as it’s a known potential side-effect of improved security, it’s not a bug at all:

The updates address the vulnerability by correcting how Office handles type libraries.

3 users thanked author for this post.

NetDef, ajcoll5, woody

Reply | Quote

[abbodi86]

FAQ for VBA solutions affected by April 2020 Office security updates

Edit:
sorry, didn’t see it was already posted

• This reply was modified 5 years, 2 months ago by abbodi86.

1 user thanked author for this post.

woody

Reply | Quote

Exactly why I have updates turned off. Typical Microsoft

Reply | Quote

But this is okay.  They know they are making this change, it’s been tested, they give a workaround it’s a known issue.  Sometimes you have to make changes to make things more secure and Office (cough phishing) is a huge huge target.

Susan Bradley Patch Lady/Prudent patcher

3 users thanked author for this post.

NetDef, ajcoll5, Elly

Reply | Quote

Susan Bradley wrote:

But this is okay

Its NOT ok.
Microsoft should have notified every single Office user about the change months before April patch
With detailed explanations about the steps need to be performed .

Reply | Quote

Alex5723 wrote:

Its NOT ok.
Microsoft should have notified every single Office user about the change months before April patch
With detailed explanations about the steps need to be performed .

It only affects Office users who load visual basic object libraries from untrusted locations.

Do you know many or any of those?

4 users thanked author for this post.

rontpxz81, Elly, Kirsty, ajcoll5

Reply | Quote