Microsoft Corp. is recommending users of Exchange 2000 and Internet Information Server 5.0 install a patch that can prevent a denial of service attack.
The vulnerability in both servers is exploited using a malformed URL, which when sent repeatedly can overwhelm either IIS or Exchange and cause a failure. Each server, however, has an automatic restart that would put the server back online quickly, according to Microsoft. The vulnerability does not allow the attacker to gain administrative control or change any data, but if exploited Web and e-mail service can be interrupted.
An attack on an Exchange 2000 Server, however, would only affect Web-based mail clients and not MAPI clients on the network. Exchange 2000 allows the use of URL-based access to the mail store within the server’s Web Storage System. In addition, since the attacker would need to sign on to the Exchange server before delivering the malformed URL, the exploit is harder to carry out on Exchange.
“The Exchange side has a higher level of security against this bug because you have to get authorization to the server,” says Chris Baker, lead product manager for Exchange Server. “Technically this could happen but there are a number of things that have to line up and the vulnerability doesn’t use a typical URL.”
The flaw is rooted in the handling of URLs that have a length within a narrow range of values. If such a URL is sent repeatedly to the server, it causes a memory allocation error that crashes the server.
Exchange and IIS have separate code that processes URLs, but the code has the same flaw. But since IIS is installed as part of Exchange 2000, an Exchange 2000 administrator needs to install both patches.