[ISN] Windows, Exchange flaws patched

Wed May 10 02:10:15 EDT 2006

http://news.com.com/Windows%2C+Exchange+flaws+patched/2100-7350_3-6070350.html

By Dawn Kawamoto 
Staff Writer, CNET News.com
Published: May 9, 2006

Microsoft on Tuesday released three security updates, two of which
address critical flaws in its Exchange e-mail server and third-party
software in Windows.

Critical vulnerabilities in Microsoft Exchange Calendar and Adobe's
Macromedia Flash Player in Windows can lead to a remote execution of
code on a user's system, according to Microsoft's security bulletins.

The software giant also issued a "moderate" update for flaws in
Windows, according to the software giant's bulletin. A malicious
attacker could launch a denial-of-service attack by sending a
specially crafted network message through the system to exploit the
flaw.

The critical Microsoft Exchange flaws affect Microsoft Exchange Server
2000 with Post-Service Pack (SP) 3, Microsoft Exchange 2000 Enterprise
Server, and Microsoft Exchange Server 2003 with SP 1 or SP 2.

"An attacker could exploit the vulnerability by constructing a
specially crafted message that could potentially allow remote code
execution when an Exchange Server processes an e-mail with
certain...properties," according to Microsoft's bulletin.

Security firm Symantec said the Microsoft Exchange flaw is the most
serious of the three.

"Because the majority of Exchange servers are configured to receive
e-mails from anonymous users, this vulnerability has the potential to
manifest itself in the form of a worm if machines are not properly
patched," Oliver Friedrichs, Symantec Security Response director, said
in a statement.

Microsoft also issued a Windows update for what it described as
critical flaws in Adobe's Macromedia Flash Player 5 and 6. An attacker
could exploit these vulnerabilities in the Flash Player by
constructing a malicious Flash animation file. Users visiting a Web
site containing the specially crafted file may find their computer
system taken over.

The Flash Player flaws affect Windows XP Home Edition, with SP 1 or SP
2; XP Professional; Windows 98 with Gold service pack or SP1; Windows
98 SE with Gold service pack; and Windows ME with Gold service pack.