Will antivirus software protect against Microsoft vulnerabilities?

Hello all,

I'm not sure I fully understand why it is important to upgrade from Windows XP or Office 2003 if antivirus will still protect me.

Take for example this vulnerability:

http://technet.microsoft.com/en-us/security/bulletin/ms11-073

Won't antivirus prevent this vulnerability from being exploited? How much of a risk is there to running Office 2003 after April 8 2014 compared to running Windows XP?

I believe there is a greater risk of running Windows XP than running Office 2003 as shown by the quote below. A Microsoft Security blog, found at http://blogs.technet.com/b/security/archive/2013/08/15/the-risk-of-running-windows-xp-after-support-ends.aspx, states:

"Some of the people I have discussed this scenario with are quick to point out that there are security mitigations built into Windows XP that can make it harder for such exploits to be successful. There is also anti-virus software that can help block attacks and clean up infections if they occur. The challenge here is that you’ll never know, with any confidence, if the trusted computing base of the system can actually be trusted because attackers will be armed with public knowledge of zero day exploits in Windows XP that could enable them to compromise the system and possibly run the code of their choice. Furthermore, can the system’s APIs that anti-virus software uses be trusted under these circumstances? For some customers, this level of confidence in the integrity of their systems might be okay, but for most it won’t be acceptable."

If I understand correctly, the antivirus software runs on top of the system's APIs, and if the system's APIs compromised, then the antivirus software will not detect a threat. Is that correct? This would explain why it would be risky to run Windows XP. Could the same thing happen with Office 2003?

Thank you for any help you can provide to help me understand this better.

Continue reading...