Severity: High
Summary:
- These vulnerabilities affect: Exchange Server 2007, 2010, and 2013
- How an attacker exploits it: By sending an email with a specially crafted email attachment
- Impact: An attacker can execute code with the restricted privileges of the LocalService account
- What to do: Deploy the appropriate Exchange Server update as soon as possible, or let Windows Automatic Update do it for you
Exposure:
Microsoft Exchange is one of the most popular email servers used today. It includes many advanced features and capabilities. One such feature, called WebReady Document Viewing, allows your email users to preview attached documents as web pages. Exchange leverages Oracle’s Outside In technology to parse these documents and provide these previews. Newer Exchange servers also have a Data Loss Prevention (DLP) feature which uses this technology
According to today’s bulletin, Exchange suffers from three vulnerabilities, including two remote code execution flaws and a cross-site scripting (XSS) vulnerability. The worst flaw has to do with the Oracle Outside In technology used by WebReady Document Viewing and DLP. By sending an email with a specially crafted attachment to your Exchange server, an attacker can exploit the worst of these flaws to execute code directly on your server. Luckily, the code only runs with LocalService account permissions, which has very limited privileges. On most Exchange servers, this attack only works against victims who check and preview mail using Exchange’s Outlook Web App (OWA). However, if you’ve enable DLP in Exchange 2013, just receiving a malicious email can trigger this flaw.
By the way, if this issue seems familiar to you, it’s because it is very similar to some previous Exchange WebReady Document Viewing issues.
Solution Path:
Microsoft has released Exchange updates to correct these vulnerabilities. You should download, test, and deploy the appropriate update as soon as possible, or let Windows Update do it for you. You can find the updates in the “Affected and Non-Affected Software” section of Microsoft’s Exchange bulletin.
Be sure to test this Exchange update before pushing it to your production servers. Administrators have had issues with past Exchange updates.
For All WatchGuard Users:
Though you can configure 0ur XTM and XCS appliances to strip certain attachments from email, this sort of attack may arrive as many types of attachments, including ones you may want to allow for business. We recommend you apply the patches instead.
Status:
Microsoft has released patches to fix these vulnerabilities.
References:
This alert was researched and written by Corey Nachreiner, CISSP (@SecAdept).