Any company that doesn't immediately download and install the upcoming fix for the Outlook vulnerabilities is just begging for more trouble. But IT folks need to get tougher - and not just with vendors. Sit down with executives in your company and discuss the plague of file attachments that has afflicted us all. If it were up to me, I'd ban all attachments that could conceivably cause damage, period, if they come from outside the corporate firewall. If they confirm it, then it's probably OK to open.
Attachments are a pain for more reasons than maintaining security, by the way.
They consume bandwidth, and mobile computer users who aren't attaching to LDAP-equipped mail servers absolutely loathe them. Until I changed e-mail clients to a product that allowed me to refuse attachments of more than a certain size, I frequently found myself wasting outrageous amounts of time downloading unwanted and universally pointless attachments in order to get to the mail I really needed. I've had a personal rule for some time when dealing with public relations people, who are unaccountably fond of sending attachments. Please send plain text only. You'll do your company a favor.