Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2012.0702
Microsoft Security Advisory (2737111) Vulnerabilities in Microsoft Exchange
and FAST Search Server 2010 for SharePoint Parsing Could
Allow Remote Code Execution
25 July 2012
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Microsoft Exchange Server
FAST Search Server 2010 for SharePoint
Publisher: Microsoft
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution: Mitigation
CVE Names: CVE-2012-3110 CVE-2012-3109 CVE-2012-3108
CVE-2012-3107 CVE-2012-3106 CVE-2012-1773
CVE-2012-1772 CVE-2012-1771 CVE-2012-1770
CVE-2012-1769 CVE-2012-1768 CVE-2012-1767
CVE-2012-1766
Reference: ASB-2012.0103
Original Bulletin:
http://technet.microsoft.com/en-us/security/advisory/2737111
Comment: While Microsoft has not yet provided a patch to correct these issues,
two workarounds have been provided in this advisory.
- --------------------------BEGIN INCLUDED TEXT--------------------
Microsoft Security Advisory (2737111)
Vulnerabilities in Microsoft Exchange and FAST Search Server 2010 for
SharePoint Parsing Could Allow Remote Code Execution
Published: Tuesday, July 24, 2012
Version: 1.0
General Information
Executive Summary
Microsoft is investigating new public reports of vulnerabilities in third-party
code, Oracle Outside In libraries, that affect Microsoft Exchange Server 2007,
Microsoft Exchange Server 2010, and FAST Search Server 2010 for SharePoint,
which ship that component. Customers that apply the workarounds described in
this advisory are not exposed to the vulnerabilities described in Oracle
Critical Patch Update Advisory - July 2012.
The vulnerabilities exist due to the way that files are parsed by the third-
party, Oracle Outside In libraries. In the most severe case of Microsoft
Exchange Server 2007 and Microsoft Exchange Server 2010, it is possible under
certain conditions for the vulnerabilities to allow an attacker to take control
of the server process that is parsing a specially crafted file. An attacker
could then install programs; view, change, or delete data; or take any other
action that the server process has access to do.
Upon completion of this investigation, Microsoft will take the appropriate
action to help protect our customers.
Mitigating Factors:
* The transcoding service in Exchange that uses the Oracle Outside In libraries
is running in LocalService account.
* Microsoft SharePoint Server is only affected by this issue when FAST Search
with Advanced Filter Pack is enabled. By default, Advanced Filter Pack in FAST
is disabled. When Advanced Filter Pack is enabled, the component that uses the
Oracle Outside In libraries is running with a restricted token.
Recommendation. Please see the Suggested Actions section of this advisory for
more information.
Advisory Details
Issue References
For more information about this issue, see the following references:
References Identification
Oracle Advisory Oracle Critical Patch Update Advisory - July 2012
CERT Reference VU#118913
CVE Reference CVE-2012-1766
CVE-2012-1767
CVE-2012-1768
CVE-2012-1769
CVE-2012-1770
CVE-2012-1771
CVE-2012-1772
CVE-2012-1773
CVE-2012-3106
CVE-2012-3107
CVE-2012-3108
CVE-2012-3109
CVE-2012-3110
Affected Software
Microsoft Exchange Server 2007 Service Pack 3
Microsoft Exchange Server 2010 Service Pack 1
Microsoft Exchange Server 2010 Service Pack 2
Microsoft SharePoint Server 2010 Service Pack 1[1]
FAST Search Server 2010 for SharePoint
[1]Microsoft SharePoint Server is only affected by this issue when FAST Search
with Advanced Filter Pack is enabled. By default, Advanced Filter Pack in FAST
is disabled. When Advanced Filter Pack is enabled, the component that uses the
Oracle Outside In libraries is running with a restricted token.
Suggested Actions
Apply Workarounds
Workarounds refer to a setting or configuration change that does not correct
the underlying issue but would help block known attack vectors before a
security update is available. See the next section, Workarounds, for more
information.
Workarounds
Disable transcoding service
1. Log in to the Exchange Management Shell as an Exchange Organization
Administrator.
2. Issue the following PowerShell command:
Get-OwaVirtualDirectory | where {$_.OwaVersion -eq 'Exchange2007'
-or $_.OwaVersion -eq 'Exchange2010'} | Set-OwaVirtualDirectory
-WebReadyDocumentViewingOnPublicComputersEnabled:$False
-WebReadyDocumentViewingOnPrivateComputersEnabled:$False
Impact of workaround. OWA users may not be able to preview the content of
email attachments.
Disable the Advanced Filter Pack
On the FAST Search Server 2010 for SharePoint administration server (or
single server), perform these steps:
1. On the Start menu, click All Programs.
2. Click Microsoft FAST Search Server 2010 for SharePoint.
3. Right-click Microsoft FAST Search Server 2010 for SharePoint shell
and select Run as administrator.
4. At the command prompt, browse to installer\scripts under the
installation folder.
5. Type the following command:
.\AdvancedFilterPack.ps1 -disable
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUA+Yve4yVqjM2NGpAQILsg//YkMe/PAroF1ZDe7e7PEva2vmyHTST9AF
+fG1TjLgb+Ies6nYiw9vXZ174WvPPmCi+TKrN09EYcBzvUXgaVElkEphnCt8dgy/
EBwNkSibwWjrnBal2pYtswESLWGFsJvW77/hK2MVptlZGBorCNXY7fVXFbdEXQPc
GpssZymPjX0aQgbeoA7eU3++swe/pDvrdH7lcMShJnZ5llbHkmGvlrF1fg1+HEHE
T4zBIOe5BaHeZnHOCVrJ+09xRW/QAb9dvEGAQjo7FPglApMmgWpZqoRTckcMYdNm
PoQGBsGCJJiXFNPQv4PRdFVuR1RlZE8aH+4Tis1o6CoQQGug5K7H1dkpwgNvZ2UO
uRGNTmTvra9lH8+D0OAK+fEHX7OCZvQYF/xwd7GjCASJNzrnKFSGLHY/biJ7iDTq
XeNBj0dzbeT/98P3z9HVEVThIcIvKt1Giv62P8Ou8zkpQwpfFFxjGS0q8MUQK5Vw
c35NzC4P99VOFYrVDAJE+NbnFcbH2IWD2N28Foe6LReUQ3nvyfmzeBiBtdg2pJk0
uPXdkIori2oO7kY2FxyaUZ3Ovo7feDhA6t7JVQtpWi9E4ciH1pNsROU3rah6F3EF
ICPCARPdZNuedJ40JMrjm04Gh2UpG/ueD64757X3UT7XS9c1fKJnxveJr7rw3Ht5
Tqo5zoDHdqo=
=Ki0A
-----END PGP SIGNATURE-----