Patches out for denial-of-service hole in Exchange
(IDG) -- Microsoft is recommending users of Exchange 2000 and Internet Information Server 5.0 install a patch that can prevent a denial of service attack.
The vulnerability in both servers is exploited using a malformed URL, which when sent repeatedly can overwhelm either IIS or Exchange and cause a failure. Each server, however, has an automatic restart that would put the server back online quickly, according to Microsoft. The vulnerability does not allow the attacker to gain administrative control or change any data, but if exploited Web and e-mail service can be interrupted.
An attack on an Exchange 2000 Server, however, would only affect Web-based mail clients and not MAPI clients on the network. Exchange 2000 allows the use of URL-based access to the mail store within the server's Web Storage System. In addition, since the attacker would need to sign on to the Exchange server before delivering the malformed URL, the exploit is harder to carry out on Exchange.
"The Exchange side has a higher level of security against this bug because you have to get authorization to the server," says Chris Baker, lead product manager for Exchange Server. "Technically this could happen but there are a number of things that have to line up and the vulnerability doesn't use a typical URL."
The flaw is rooted in the handling of URLs that have a length within a narrow range of values. If such a URL is sent repeatedly to the server, it causes a memory allocation error that crashes the server.
Exchange and IIS have separate code that processes URLs, but the code has the same flaw. But since IIS is installed as part of Exchange 2000, an Exchange 2000 administrator needs to install both patches.
University computers remain hacker havens
RELATED IDG.net STORIES:
New IIS tool helps administrators keep servers secure
Microsoft IIS 5.0 patch
Study: Gadget sales flat
Protest slams Dell's use of prison labor
Steve Jobs keeps Apple in the limelight
N. Y. plans to heal skyline
Stocks rise on Case departure
Lieberman's presidential announcement today
New arrests may be linked to UK ricin scare
Jordan says farewell for the third time
Shaq could miss playoff game for child's birth
Ex-USOC official says athletes bent drug rules
|Back to the top|