CERT-In Vulnerability Note
CIVN-2010-0269
Microsoft Exchange Server Infinite Loop Denial of Service Vulnerability
Original Issue Date:December 15, 2010
Severity Rating: MEDIUM
Systems Affected
- Microsoft Exchange Server 2007 Service pack 2 for x64-based system
Overview
A vulnerability has been reported in Microsoft Exchange server store. Successful exploitation of these vulnerability could allow an attacker to cause Denial of service condition.
Description
The Exchange Server store is a storage platform that provides a single repository for managing multiple types of information in one infrastructure. The Exchange store has several logical components that interact with each other. These components can reside on a single server, or they can be distributed across multiple servers Microsoft Remote Procedure Call (RPC) is an interprocess communication (IPC) mechanism that enables data exchange and invocation of functionality residing in a different process
A denial of service vulnerability is reported in Microsoft Exchange Server store while processes RPC calls. The vulnerable code path is only accessible to authenticated users. The specific flaw exists within store.exe during the handling of a particular MAPI call. The service will enter a loop whose termination is controlled by an attacker. If the attacker specifies an invalid value, the loop will never terminate causing the service to stop responding to requests.
An authenticated attacker could exploit the vulnerability by sending a specially crafted network message to a computer running the Exchange service. Successful exploitation of this vulnerability requires a server to be configured with the "Mailbox Server" role that cause the Exchange service to stop responding until manually restarted.
Solution
Apply appropriate updates as mentioned in the Microsoft Security Bulletin
MS10-106
Vendor Information
Microsoft
http://www.microsoft.com/technet/security/bulletin/MS10-106.mspx
References
Zerodayinitiative
http://www.zerodayinitiative.com/advisories/ZDI-10-286/
Microsoft
http://www.microsoft.com/technet/security/bulletin/MS10-106.mspx
AUS-CERT
http://www.auscert.org.au/render.html?it=13733
Secunia
http://secunia.com/advisories/42633/
SecurityTracker
http://securitytracker.com/alerts/2010/Dec/1024888.html
Vupen
http://www.vupen.com/english/advisories/2010/3228
ISS.NET
http://xforce.iss.net/xforce/xfdb/63572
CVE Name
CVE-2010-3937
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|