Microsoft Exchange Heap Overlow in Processing Extended SMTP Verb Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1013687
|
|
SecurityTracker URL: http://securitytracker.com/id?1013687
|
|
CVE Reference: CAN-2005-0560
(Links to External Site)
|
Date: Apr 12 2005
|
Impact: Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Microsoft Security Bulletin
|
Version(s): 2000 SP3, 2003, 2003 SP1
|
Description: A buffer overflow vulnerability was reported in Microsoft Exchange. A remote user can execute arbitrary code on the target system.
A remote user can connect to the Exchange SMTP service and supply a specially crafted extended SMTP verb to trigger a heap overflow.
Arbitrary code will be executed with System privileges.
On Exchange 2003, authentication is required by default before the specific
extended SMTP verb can be supplied. On Exchange 2000, no authentication is required.
The vendor credits Mark Dowd and Ben Layer
of ISS X-Force with reporting this vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system with System level privileges.
|
Solution: The vendor has issued the following fixes:
Microsoft Exchange 2000 Server Service Pack 3:
http://www.microsoft.com/downloads/details.aspx?FamilyId=2A2AF17E-2E4A-4479
-8AC9-B5544EA0BD66
Microsoft Exchange Server 2003:
http://www.microsoft.com/downloads/details.aspx?FamilyId=97F409EB-C8D0-4C94-A67B-5945E26C9267
Microsoft
Exchange Server 2003 Service Pack 1:
http://www.microsoft.com/downloads/details.aspx?FamilyId=35BCE74A-E84A-4035-BF18-196368F032CC
A
restart is not required if all applications are closed prior to installation. The security update will restart the IIS, SMTP, and
the Exchange Server Information Store Service. The File Transfer Protocol (FTP) and Network News Transfer Protocol (NNTP) services
will also be affected.
|
Vendor URL: www.microsoft.com/technet/security/Bulletin/MS05-021.mspx (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (2000), Windows (2003), Windows (XP)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 12 Apr 2005 11:54:34 -0400
Subject: http://www.microsoft.com/technet/security/Bulletin/MS05-021.mspx
|
http://www.microsoft.com/technet/security/Bulletin/MS05-021.mspx
|
|
