Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Vulnerabilities in Microsoft Exchange Could Allow Remote Code Execution (931832) |
| Informations | |||
|---|---|---|---|
| Name | MS07-026 | First vendor Publication | 2007-05-08 |
| Vendor | Microsoft | Last vendor Modification | 2009-05-26 |
| Severity (Vendor) | Critical | Revision | 1.1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Revision Note: V1.1 (May 26, 2009): Added an entry in the section, Frequently Asked Questions (FAQ) Related to This Security Update, to announce a detection change. The detection no longer offers the MS06-019 and MS06-029 updates, but instead will only offer MS07-026. There were no changes to the binaries. Customers who have already successfully installed the MS07-026 update do not need to reinstall.Summary: This update resolves several newly discovered, privately reported vulnerabilities. Each vulnerability is documented in its own subsection in the Vulnerability Details section of this bulletin. An attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. We recommend that customers apply the update immediately. |
Original Source
| Url : http://www.microsoft.com/technet/security/bulletin/MS07-026.mspx |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 25 % | CWE-476 | NULL Pointer Dereference |
| 25 % | CWE-190 | Integer Overflow or Wraparound (CWE/SANS Top 25) |
| 25 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
| 25 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:1371 | |||
| Oval ID: | oval:org.mitre.oval:def:1371 | ||
| Title: | Outlook Web Access Script Injection Vulnerability | ||
| Description: | Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label". | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2007-0220 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | Microsoft Exchange Server |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1593 | |||
| Oval ID: | oval:org.mitre.oval:def:1593 | ||
| Title: | Malformed iCal Vulnerability | ||
| Description: | The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2007-0039 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista | Product(s): | Microsoft Exchange Server |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1890 | |||
| Oval ID: | oval:org.mitre.oval:def:1890 | ||
| Title: | MIME Decoding Vulnerability | ||
| Description: | Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2007-0213 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista | Product(s): | Microsoft Exchange Server |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:2054 | |||
| Oval ID: | oval:org.mitre.oval:def:2054 | ||
| Title: | IMAP Literal Processing Vulnerability | ||
| Description: | Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (service hang) via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability." | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2007-0221 | Version: | 2 |
| Platform(s): | Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 | Product(s): | Microsoft Exchange Server |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 4 |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 34392 | Microsoft Exchange Server IMAP Literal Processing DoS Exchange Server contains a flaw that may allow a remote denial of service. The issue is triggered when the IMAP4 service processes an IMAP command with crafted literals, and will result in loss of availability for the service. |
| 34391 | Microsoft Exchange Server MIME Decoding Remote Code Execution A remote code execution flaw exists in Exchange Server. It fails to validate base64-encoded content, allowing a specially crafted email to execute arbitrary code, resulting in a loss of integrity. |
| 34390 | Microsoft Exchange Server MODPROPS Malformed iCal DoS Exchange Server contains a flaw that may allow a remote denial of service. The issue is triggered by a specially crafted iCal file with multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties, and will result in loss of availability for the service. |
| 34389 | Microsoft Exchange Outlook Web Access (OWA) Attachment Script Injection Exchange Server contains a flaw that may allow a malicious user to execute arbitrary code. The issue is triggered by incorrect handling of a UTF character set label by Outlook Web Access. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity. |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2007-05-10 | IAVM : 2007-A-0031 - Multiple Vulnerabilities in Microsoft Exchange Severity : Category I - VMSKEY : V0014220 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | login literal format string attempt RuleID : 2665-community - Revision : 13 - Type : PROTOCOL-IMAP |
| 2014-01-10 | login literal format string attempt RuleID : 2665 - Revision : 13 - Type : PROTOCOL-IMAP |
| 2014-01-10 | Microsoft Windows Exchange MODPROPS denial of service attempt RuleID : 21776 - Revision : 8 - Type : SERVER-MAIL |
| 2014-01-10 | login literal buffer overflow attempt RuleID : 1993-community - Revision : 24 - Type : PROTOCOL-IMAP |
| 2014-01-10 | login literal buffer overflow attempt RuleID : 1993 - Revision : 24 - Type : PROTOCOL-IMAP |
| 2014-01-10 | Microsoft Exchange MODPROPS denial of service PoC attempt RuleID : 14742 - Revision : 5 - Type : SPECIFIC-THREATS |
| 2014-01-10 | Microsoft Exchange Server MIME base64 decoding code execution attempt RuleID : 12028 - Revision : 8 - Type : SERVER-MAIL |
| 2014-01-10 | Exchange MODPROPS denial of service attempt RuleID : 11222 - Revision : 9 - Type : SMTP |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2007-05-08 | Name : Arbitrary code can be executed on the remote host through the email server. File : smb_nt_ms07-026.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:45:40 |
|
| 2014-01-19 21:30:04 |
|
| 2013-11-11 12:41:05 |
|
| 2013-05-11 00:49:16 |
|
