Microsoft Exchange Server under major security risk
On the face of it, Microsoft’s latest monthly update seems quite light with ‘just’ two critical vulnerabilities. But one of them, for Exchange Server, is an absolute doozy.
The issue, which affects the 2000, 2003 and 2007 editions, means that a hacker could take complete control of a system – with administrative privileges – simply by sending a specially crafted message with a rogue winmail.dat file, the attachment which tells e-mail programs how to display a Rich Text Format document. To make things worse, the problem could affect users who simply preview the message without having to open it.
The vulnerability is understandably rated critical, though Microsoft’s separate exploitability index gives it a medium rating for the likelihood of hackers taking advantage. That’s a fairly arbitrary rating based on the fact that there’s no evidence the hacking community has figured out how to exploit the issue yet.
Some security analysts believe this issue exposes a flaw in the way the exploitability index works, arguing that the potential rewards are so high that hackers will make it their top priority no matter how difficult the task proves. Andrew Storm of nCircle predicts a solution could be public inside a week, arguing that “attackers are going to latch onto this like flies to honey.” The fear is that some system administrators may prioritize the ‘more important’ patches ahead of the Exchange Server fix.
The other critical vulnerability this month affects Internet Explorer (version 7 only). It’s the now familiar situation of hackers being able to take control of computers after users view infected websites. In this specific case, the issues involve the ways Internet Explorer deals with cascading style sheets and deleted objects.
The other two fixes, both rated as important, are for a longstanding problem with Microsoft SQL server and a bug in Visio.
Related Posts:
February 14th, 2009
And I thought unprotected sex was risky. ha!