Technical Information

Brief overview of the risk:
A denial of service vulnerability exists in Microsoft Exchange Server because of the way that it handles invalid IMAP requests. An attacker could exploit the vulnerability by sending a specially crafted IMAP command to a Microsoft Exchange Server configured as an IMAP server. An attacker successfully exploiting this vulnerability could cause the mail service to stop responding.
Detailed Information on the risk:
This bulletin covers four vulnerabilities in Microsoft Exchange Server. The most important of these is a heap overflow during decoding of Base 64 encoded MIME attachments. To exploit this vulnerability, an attacker would direct a specially-crafted email to a victim user. The user would have to view the email through the Outlook Web Access, IMAP, or POP3 interface in order for the exploit to work. Users reading mail through MAPI interfaces cannot trigger this exploit. Once the exploit is triggered, the attacker has complete control over the Exchange server. The second vulnerability allows an attacker to execute web scripts within the context of Outlook Web Access when a user views a specially crafted HTML email. This attack is similar to a cross-site scripting attack. Its most common application is likely to be theft of the victim’s access credentials for the Outlook Web Server. The other two vulnerabilities are denial of service issues. An attacker with unauthenticated access to the Exchange IMAP Server could crash the server by sending a malformed string literal. Attackers could also crash Exchange by sending an email with a malformed iCal file to any user on the server.Further information on this exploit is available at : MS07-026