----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Exchange Server TNEF Decoding and MAPI Command Processing
Vulnerabilities

SECUNIA ADVISORY ID:
SA33838

VERIFY ADVISORY:
http://secunia.com/advisories/33838/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
Microsoft Exchange Server 2003
http://secunia.com/advisories/product/1828/
Microsoft Exchange Server 2007
http://secunia.com/advisories/product/13797/
Microsoft Exchange Server 2000
http://secunia.com/advisories/product/41/

DESCRIPTION:
Some vulnerabilities have been reported in Microsoft Exchange Server,
which can be exploited by malicious people to cause a DoS (Denial of
Service) or potentially compromise a vulnerable system.

1) An unspecified error exists within the decoding of Transport
Neutral Encapsulation Format (TNEF) data. This can be exploited to
cause a memory corruption, e.g. when a user opens or previews a
specially crafted e-mail message sent in TNEF format or when the
Microsoft Exchange Server Information Store processes the specially
crafted message.

Successful exploitation may allow execution of arbitrary code.

2) An error exists within the processing of MAPI commands in the
EMSMDB2 (Electronic Messaging System Microsoft Data Base, 32 bit
build) provider. This can be exploited to cause the application to
stop responding by sending a specially crafted MAPI command using the
EMSMDB32 provider.

NOTE: This also affects the Microsoft Exchange System Attendant,
which uses the EMSMDB32 provider.

SOLUTION:
Apply the patches.

Microsoft Exchange 2000 Server SP3 (with the Update Rollup of August
2004):
http://www.microsoft.com/downloads/details.aspx?familyid=805dc856-ea60-477d-be40-6ac535a7e7e5

Microsoft Exchange Server 2003 SP2
http://www.microsoft.com/downloads/details.aspx?familyid=1d9f0956-88bd-4e13-a86b-b1c8d4782f71

Microsoft Exchange Server 2007 SP1:
http://www.microsoft.com/downloads/details.aspx?familyid=93cb3f66-ae72-4356-bdbf-35029cff6df1

PROVIDED AND/OR DISCOVERED BY:
1) Reported by the vendor.
2) The vendor credits Bogdan Materna, VoIPshield Systems.

ORIGINAL ADVISORY:
MS09-003 (KB959239, KB959897, KB959241):
http://www.microsoft.com/technet/security/bulletin/ms09-003.mspx

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------