=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN051
_____________________________________________________________________

DATE                : 13/02/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running Microsoft Exchange Server
                                 versions 2007, 2010.

======================================================================
KB2809279
https://technet.microsoft.com/en-us/security/bulletin/ms13-012
______________________________________________________________________

Microsoft Security Bulletin MS13-012 - Critical Vulnerabilities in
Microsoft Exchange Server Could Allow Remote Code Execution
(2809279)

Published Date: February 12, 2013

Version: 1.0


General Information

Executive Summary

This security update resolves publicly disclosed vulnerabilities in
Microsoft Exchange Server. The most severe vulnerability is in
Microsoft Exchange Server WebReady Document Viewing, and could allow
remote code execution in the security context of the transcoding
service on the Exchange server if a user previews a specially crafted
file using Outlook Web App (OWA). The transcoding service in Exchange
that is used for WebReady Document Viewing is running in the
LocalService account. The LocalService account has minimum privileges on
the local computer and presents anonymous credentials on the network.

This security update is rated Critical for all supported editions of
Microsoft Exchange Server 2007 and Microsoft Exchange Server 2010.


Affected Software

Microsoft Exchange Server 2007 Service Pack 3
Microsoft Exchange Server 2010 Service Pack 2


Vulnerability Information

Oracle Outside In Contains Multiple Exploitable Vulnerabilities
Two vulnerabilities exist in Microsoft Exchange Server through the
WebReady Document Viewing feature. The more severe vulnerability,
CVE-2013-0418, could allow remote code execution as the LocalService
account if a user views a specially crafted file through Outlook Web
Access in a browser. An attacker who successfully exploited this
vulnerability could run code on the affected Exchange Server, but only
as the LocalService account. The LocalService account has minimum
privileges on the local computer and presents anonymous
credentials on the network. The other vulnerability, CVE-2013-0393,
could cause the affected Exchange Server to become unresponsive if a
user views a specially crafted file through Outlook Web Access in a
browser. Note that CVE-2013-0393 would not allow an attacker to execute
code or to elevate user rights.

======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================