MS07-026: Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (931832)

[The_Exchange_Team]

An Exchange Server related security bulletin was released yesterday. Here are some details; please go and get the patches that apply to your Exchange version!

Issued: May 08, 2007

Impact of Vulnerability: Remote Code Execution

Maximum Severity Rating: Critical

Recommendation: Customers should apply the update immediately

Security Update Replacement: This bulletin replaces two prior security updates. See the Frequently Asked Questions (FAQ) section of the bulletin for details.

Affected Software:

• Microsoft Exchange 2000 Server Service Pack 3 with the Exchange 2000 Post-Service Pack 3 Update Rollup of August 2004
• Microsoft Exchange Server 2003 Service Pack 1
• Microsoft Exchange Server 2003 Service Pack 2
• Microsoft Exchange Server 2007

Please go here for more information and links to get the updates!

Additionally, you can read about all patches released yesterday on the Microsoft Security Response Center (MSRC) blog.

EDIT: One additional note about those fixes for Exchange 2000 and 2003. Please be aware that those fixes include the "Send As" behavior change as discussed in this KB article. Functionality of your 3rd party applications might be affected. Please make sure to check the article 912918!

- Nino Bilic

[#2]

931832 includes exosal.dll which is one file also in KB 916783 - (disabled user account and 9548 errors in the event log).  Should 931832 change the Exchange server to behave as if 916783 is installed, even if it is not??   (ie is the optional 916783 now no longer optional because it is in 931832?

We did have 916783 installed but later decided we wanted it removed. and I have been able to desired behavour by eventually returning exosal.dll to the original exchange version! (Unistalls didn't do this!)  But 931832 puts a version of exosal.dll greater than 916783 and we again have the problem of mail delivering to disabled accounts.

[#3]

I think I have answered my own query.  I had a front end server that never had 916783 and the 931832 hotfix definitely does change the behaviour for disabled accounts.  This is a real pain for us as we have a custom developed Identity management system that automatically disables accounts.  Now we have to develop a new process to stop email delivery.  It is annoying that this embedded functionality change in the security hotfix wasn't better advertised jsut like the "Send As" change was alerted to.

[#4]

Soon after we installed the 931832 patch, we also experienced mail

flow issues where messages would not be delivered and were being

held in the local delivery queue. Installing patch 934450 did

resolve this problem, however we now have a different mail flow

issue whereby emails are intermittently being delivered to the journal mailbox and not to the intended recipient. When this happens we have 2 entries from the smtp store driver delivering to our journal mailbox when viewing the  message in message tracking centre. We'd expect to see only 1 entry for the journal mailbox and 1 entry for the recipient mailbox from the smtp store driver.
Has anyone experienced the same problem with patch 934450?

Our store.exe version is currently 6.5.7653.2. Is there a patch / hotfix which supercedes 934450?