Patch issued for Exchange 2000

Microsoft Corp. is recommending users of Exchange 2000 and Internet Information Server 5.0 install a patch that can prevent a denial of service attack.

The vulnerability in both servers is exploited using a malformed URL, which when sent repeatedly can overwhelm either IIS or Exchange and cause a failure. Each server, however, has an automatic restart that would put the server back online quickly, according to Microsoft. The vulnerability does not allow the attacker to gain administrative control or change any data, but if exploited Web and e-mail service can be interrupted.

An attack on an Exchange 2000 Server, however, would only affect Web-based mail clients and not MAPI clients on the network. Exchange 2000 allows the use of URL-based access to the mail store within the server’s Web Storage System. In addition, since the attacker would need to sign on to the Exchange server before delivering the malformed URL, the exploit is harder to carry out on Exchange.

“The Exchange side has a higher level of security against this bug because you have to get authorization to the server,” says Chris Baker, lead product manager for Exchange Server. “Technically this could happen but there are a number of things that have to line up and the vulnerability doesn’t use a typical URL.”

The flaw is rooted in the handling of URLs that have a length within a narrow range of values. If such a URL is sent repeatedly to the server, it causes a memory allocation error that crashes the server.

Exchange and IIS have separate code that processes URLs, but the code has the same flaw. But since IIS is installed as part of Exchange 2000, an Exchange 2000 administrator needs to install both patches.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Related Tech News

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Featured Reads