====================================================================

                                     CERT-Renater

                        Note d'Information No. 2016/VULN324
_____________________________________________________________________

DATE                : 14/09/2016

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Microsoft Exchange Server versions
                                    2007, 2010, 2013, 2016.

=====================================================================
KB3185883
https://technet.microsoft.com/en-us/library/security/MS16-108
____________________________________________________________________

Microsoft Security Bulletin MS16-108: Critical Security Update for
Microsoft Exchange Server (3185883)


Executive Summary

This security update resolves vulnerabilities in Microsoft Exchange
Server.
The most severe of the vulnerabilities could allow remote code
execution in some Oracle Outside In libraries that are built into
Exchange Server if an attacker sends an email with a specially crafted
attachment to a vulnerable Exchange server.

This security update is rated Critical for all supported editions of
Microsoft Exchange Server 2007, Microsoft Exchange Server 2010,
Microsoft Exchange Server 2013, and Microsoft Exchange Server 2016.


Affected Software

Microsoft Exchange Server 2007

Microsoft Exchange Server 2010

Microsoft Exchange Server 2013

Microsoft Exchange Server 2016


Vulnerability Information

Oracle Outside In Libraries Vulnerabilities

This security update addresses the following vulnerabilities, which are
described in Oracle Critical Patch Update Advisory July 2016:

Remote Code Execution: CVE-2016-3575, CVE-2016-3581, CVE-2016-3582,
CVE-2016-3583, CVE-2016-3595, CVE-2016-3594, CVE-2015-6014,
CVE-2016-3593, CVE-2016-3592, CVE-2016-3596, CVE-2016-3591


Information Disclosure: CVE-2016-3574

Denial of Service: CVE-2016-3576, CVE-2016-3577, CVE-2016-3578,
CVE-2016-3579, CVE-2016-3580, CVE-2016-3590


Microsoft Exchange Information Disclosure Vulnerability - CVE-2016-0138

An information disclosure vulnerability exists in the way that
Microsoft Exchange Server parses email messages. The vulnerability
could allow an attacker to discover confidential user information that
is contained in Microsoft Outlook applications.

To exploit the vulnerability, an attacker could use "send as" rights to
send a specially crafted message to a user.

The security update addresses the vulnerabilities by correcting how
Microsoft Exchange parses certain unstructured file formats.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:


Vulnerability title  CVE number  Publicly disclosed  Exploited

Microsoft Exchange Information
Disclosure Vulnerability   CVE-2016-0138    No     No


Microsoft Exchange Open Redirect Vulnerability - CVE-2016-3378

An open redirect vulnerability exists in Microsoft Exchange that could
lead to Spoofing. To exploit the vulnerability, an attacker could send
a link that has a specially crafted URL, and convince the user to click
the link. When an authenticated Exchange user clicks the link, the
authenticated user's browser session could be redirected to a malicious
site that is designed to impersonate a legitimate website. By doing so,
the attacker could trick the user and potentially acquire sensitive
information, such as the user's credentials.

The update addresses the vulnerability by correcting how Exchange
handles open redirect requests.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title   CVE number   Publicly disclosed 	Exploited

Microsoft Exchange Open
Redirect Vulnerability 	 CVE-2016-3378 	  No 	        No


Microsoft Exchange Elevation of Privilege Vulnerability - CVE-2016-3379

An elevation of privilege vulnerability exists in the way that
Microsoft Outlook handles meeting invitation requests. To exploit the
vulnerability, an attacker could send a specially crafted Outlook
meeting invitation request with malicious cross-site scripting (XSS)
capability to a user.

The update addresses the vulnerability by correcting how Outlook
handles meeting invitation requests.

The following table contains links to the standard entry for each
vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title   CVE number   Publicly disclosed 	Exploited

Microsoft Exchange Elevation
of Privilege Vulnerability   CVE-2016-3379     No 	No


==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================