Microsoft released a warning regarding a security flaw in the SMTP engine of Exchange 2000 and 2003.
Exchange 2000 are at a greater risk because they can be compromised by an anonymous users while using this vulnerability on Exchange 2003 requires authentication to special Exchange groups which in most cases is highly unlikely unless you add a user to the Exchange Enterprise Servers or Exchange Domain Servers groups with a blank or some other easy to guess password. The patch provided by Microsoft actually adds to Exchange 2000 the authentication requirements already present in Exchange 2003.
No restart of the computer is required provided all applications are closed before installation (including applications opened through a terminal server session). However, the security update will restart the IIS, SMTP, and the Exchange Server Information Store Service. The File Transfer Protocol (FTP) and Network News Transfer Protocol (NNTP) services will also be affected.
For more information:
http://support.microsoft.com/?kbid=894549
http://www.microsoft.com/technet/security/bulletin/ms05-021.mspx
Download links:
Exchange 2000 SP3
http://www.microsoft.com/downloads/details.aspx?FamilyId=2A2AF17E-2E4A-4479-8AC9-B5544EA0BD66
Exchange 2003
http://www.microsoft.com/downloads/details.aspx?FamilyId=97F409EB-C8D0-4C94-A67B-5945E26C9267
Exchange 2003 SP1
http://www.microsoft.com/downloads/details.aspx?FamilyId=35BCE74A-E84A-4035-BF18-196368F032CC
About Amit Zinman
Currently working as Project Manager and Systems Consultant, heading and consulting on Exchange and NT/Windows 2000 based migrations and deployments for large companies such as Checkpoint, Comverse, Smarteam, Nice, Aladdin and leading Israeli Banks, Also involved in writing scripts and custom solutions for clients based on ADSI, CDO and Visual Basic and teaching Windows 2000 and Exchange 2000 in MSCE colleges and lecturing in Microsoft User Groups.
Click here for Amit Zinman's section.
Receive all the latest articles by email!
Get all articles delivered directly to your mailbox as and when they are released on MSExchange.org! Choose between receiving instant updates with the Real-Time Article Update, or a monthly summary with the Monthly Article Update. Sign up to the MSExchange.org Monthly Newsletter, written by Exchange MVP Henrik Walther, containing news, the hottest tips, Exchange links of the month and much more. Subscribe today and don't miss a thing!
