Vulnerability:Microsoft Exchange Inappropriate Registry Permissions

[s0nIc]

Microsoft Exchange Inappropriate Registry Permissions Vulnerability


A flaw has been reported in the Microsoft Exchange System Attendant, which could allow unprivileged users access to the WinReg key.
The WinReg key controls users and groups ability to connect remotely to the registry.


The System Attendant must ensure the that the Microsoft Exchange System Manager can remotely connect, in doing so, the System Attendant adds the 'Everyone' group to the WinReg key.

Exploit: No exploit code required.

Remote: Yes

Solution: Microsoft has released a patch which addresses this issue:
http://download.microsoft.com/download/exchangeentserver/Patch/ 06.00.21.5770/NT5/EN-US/Q316056engi386.EXE

[the_g_nee]

No way! Not another vulnerability found! :rofl:

I can't believe this, maybe we should ask JP to open up another forum

specifically for vulnerabilities found in M$ products.

There must be loads floating around the AO site by now!



:)

[gold eagle]

There must twenty a day. Imagine if you could make money off them all.

[{P²P}Apocalypse]

Originally posted by s0nIc
Microsoft Exchange Inappropriate Registry Permissions Vulnerability

Exploit: No exploit code required.

Remote: Yes


This is the part that alarms me. NO expliot code required. You think the idiots at MS would at the least make their screwups a little hadder to break into. O well this just adds more greese to the open source wheel.

[s0nIc]

lmao scares me too.. and so as the fact that it can be done REMOTELY without an exploit...
Bill! give your products some dignity ol boy! lolz