MS07-026: Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (931832)

Robert: The change in behavior is documented here: http://support.microsoft.com/kb/903158 ... but chances are you are already have the changes if you applied the Timezone update... which also includes a copy of store.exe

I opened a case with Microsoft that verified that 926666 includes the update 903158.  Below is the workaround that they sent me:


Step 1 Create a dummy account:
=======================
1). Please create a dummy account (e.g. names it dummyaccount) through Active Directory Users and Computers (ADUC).
2). Make it mail enabled.

Step 2 Set the Delivery restriction:
=======================
1). Open Active Directory Users and Computers (ADUC).
2). Right click the user object and select properties.
3). Select Exchange General tab; click Delivery Restriction button.
4). On the Delivery Restrictions property window, select Only From under Message Restrictions and add the dummy account to the list.
5). Click OK.
6). Wait a while for DC replication.

I just wish this functionality could be disabled/enabled via the registry.