Microsoft Exchange iCal Request Remote Denial of Service Vulnerability
BID:23808
Info
Microsoft Exchange iCal Request Remote Denial of Service Vulnerability
| Bugtraq ID: | 23808 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2007-0039 |
| Remote: | Yes |
| Local: | No |
| Published: | May 08 2007 12:00AM |
| Updated: | May 17 2007 09:58PM |
| Credit: | Alexander Sotirov of Determina Security Research is credited with the discovery of this vulnerability. |
| Vulnerable: |
Microsoft Exchange Server 2007 0 Microsoft Exchange Server 2003 SP2 Microsoft Exchange Server 2003 SP1 Microsoft Exchange Server 2003 Microsoft Exchange Server 2000 SP3 Microsoft Exchange Server 2000 SP2 Microsoft Exchange Server 2000 SP1 Microsoft Exchange Server 2000 Avaya Messaging Application Server MM 3.1 Avaya Messaging Application Server MM 3.0 Avaya Messaging Application Server MM 2.0 Avaya Messaging Application Server 0 |
| Not Vulnerable: | |
Discussion
Microsoft Exchange iCal Request Remote Denial of Service Vulnerability
Microsoft Exchange is prone to a remote denial-of-service vulnerability because it fails to properly handle unexpected iCal message content.
Successfully exploiting this issue allows remote attackers to cause targeted Exchange servers to stop responding to further requests for sending, receiving, or accessing email. As a result, denial-of-service conditions occur for legitimate users of affected servers. A denial-of-service condition will persist until an administrator restarts the Microsoft Exchange Information Store service.
Microsoft Exchange is prone to a remote denial-of-service vulnerability because it fails to properly handle unexpected iCal message content.
Successfully exploiting this issue allows remote attackers to cause targeted Exchange servers to stop responding to further requests for sending, receiving, or accessing email. As a result, denial-of-service conditions occur for legitimate users of affected servers. A denial-of-service condition will persist until an administrator restarts the Microsoft Exchange Information Store service.
Exploit / POC
Microsoft Exchange iCal Request Remote Denial of Service Vulnerability
Attackers exploit this issue by sending specially crafted email messages containing iCal content.
Attackers exploit this issue by sending specially crafted email messages containing iCal content.
Solution / Fix
Microsoft Exchange iCal Request Remote Denial of Service Vulnerability
Solution:
The vendor has released an advisory along with updates to address this issue. Please see the referenced advisory for more information.
Microsoft Exchange Server 2007 0
Microsoft Exchange Server 2000 SP3
Microsoft Exchange Server 2000 SP2
Microsoft Exchange Server 2003 SP1
Microsoft Exchange Server 2000 SP1
Microsoft Exchange Server 2003 SP2
Microsoft Exchange Server 2000
Solution:
The vendor has released an advisory along with updates to address this issue. Please see the referenced advisory for more information.
Microsoft Exchange Server 2007 0
-
Microsoft Update Rollup 2 for Exchange Server 2007 (KB935490)
http://www.microsoft.com/downloads/details.aspx?familyid=356874EF-C9C0 -4842-99F0-E449E9940358
Microsoft Exchange Server 2000 SP3
-
Microsoft Security Update for Exchange 2000 Server (KB931832)
http://www.microsoft.com/downloads/details.aspx?familyid=21968843-4A81 -4F1D-8207-5B0A710E3157
Microsoft Exchange Server 2000 SP2
-
Microsoft Security Update for Exchange 2000 Server (KB931832)
http://www.microsoft.com/downloads/details.aspx?familyid=21968843-4A81 -4F1D-8207-5B0A710E3157
Microsoft Exchange Server 2003 SP1
-
Microsoft Security Update for Exchange Server 2003 SP1 (KB931832)
http://www.microsoft.com/downloads/details.aspx?familyid=5E7939BE-73D1 -461C-8C79-EDDB0F1459FC
Microsoft Exchange Server 2000 SP1
-
Microsoft Security Update for Exchange 2000 Server (KB931832)
http://www.microsoft.com/downloads/details.aspx?familyid=21968843-4A81 -4F1D-8207-5B0A710E3157
Microsoft Exchange Server 2003 SP2
-
Microsoft Security Update for Exchange Server 2003 SP2 (KB931832)
http://www.microsoft.com/downloads/details.aspx?familyid=1ABF93DA-D765 -4876-96B5-ACB2D2A48F8F
Microsoft Exchange Server 2000
-
Microsoft Security Update for Exchange 2000 Server (KB931832)
http://www.microsoft.com/downloads/details.aspx?familyid=21968843-4A81 -4F1D-8207-5B0A710E3157
References
Microsoft Exchange iCal Request Remote Denial of Service Vulnerability
References:
References:
- Exchange Server Home Page (Microsoft)
- Exchange Calendar MODPROPS Denial of Service (CVE-2007-0039) (Alexander Sotirov)
- ASA-2007-191 MS07-026 Vulnerabilities in Microsoft Exchange Could Allow Remote C (Avaya)
- Microsoft Security Bulletin MS07-026 (Microsoft)