Microsoft Exchange Server Remote Code Execution Vulnerabilities

Last Update Date: 13 Dec 2013 Release Date: 11 Dec 2013 3270 Views

RISK: High Risk

TYPE: Servers - Other Servers

Oracle Outside In Contains Multiple Exploitable Vulnerabilities
Two of the vulnerabilities addressed in this bulletin, CVE-2013-5763 and CVE-2013-5791, exist in Exchange Server 2007, Exchange Server 2010, and Exchange Server 2013 through the WebReady Document Viewing feature. The vulnerabilities could allow remote code execution as the LocalService account if a user views a specially crafted file through Outlook Web Access in a browser. An attacker who successfully exploited this vulnerability could run code on the affected Exchange Server, but only as the LocalService account. The LocalService account has minimum privileges on the local computer and presents anonymous credentials on the network.
In addition, CVE-2013-5763 and CVE-2013-5791 exist in Exchange Server 2013 through the Data Loss Protection (DLP) feature. This vulnerability could cause the affected Exchange Server to become unresponsive if a user sends or receives a specially crafted file.
MAC Disabled Vulnerability
A remote code execution vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the Outlook Web Access (OWA) service account.
OWA XSS Vulnerability
An elevation of privilege vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could run script in the context of the current user.