Exchange 2007 SP1 Update Rollup 6 arrives

February 11, 2009 · Filed Under Exchange Server 2007 | 492 views

Patch Tuesday this month brought an usual update: Update Rollup 6. That’s unusual for an UR to appear on Patch Tuesday…but in this case there are two security fixes that are rated as Critical, so the timing makes sense.

Get the UR here and install it as soon as possible. No mention of whether or not this UR fixes the bug identified with SCR in UR5 or not.

Microsoft Security Bulletin MS09-003 explains the two vulnerabilities in general terms. Sounds bad, generally speaking.

This security update resolves two privately reported vulnerabilities in Microsoft Exchange Server.

The first vulnerability could allow remote code execution if a specially crafted TNEF message is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could take complete control of the affected system with Exchange Server service account privileges.

The second vulnerability could allow denial of service if a specially crafted MAPI command is sent to a Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could cause the Microsoft Exchange System Attendant service and other services that use the EMSMDB32 provider to stop responding.

MS KB 959241 contains the full list of updates and fixes.

Update Rollup 6 for Exchange Server 2007 SP1 fixes the issues that are described in the following Microsoft Knowledge Base articles:

950675:  Downloaded .xls file attachments are empty when you open the files by using Outlook Web Access on Exchange Server 2007 Service Pack 1

955443:  Some free/busy messages are not replicated from Exchange 2007 to Exchange 2003 servers after some mailboxes are migrated from Exchange Server 2003 to Exchange Server 2007

956536:  The Microsoft Exchange File Distribution service uses lots of memory and processor time when Exchange Server 2007 processes many OABs

956624:  The Microsoft Exchange Transport service crashes continuously after you enable journal rule or deploy an antivirus application on an Exchange Server 2007 server

957748:  The custom message class of contact object is overwritten by the normal IPM.Contact class when an Exchange 2007 server replicates the contact object to any other public store

959239:  MS09-003: Vulnerabilities in Microsoft Exchange could allow remote code execution