Microsoft has found a critical problem in the WebReady Document Viewing and Data Loss Prevention modules of Exchange, which can lead to remote code execution in Exchange.

See the Security Bulletin MS13-061 from Microsoft and download the updates to you favorite Exchange version.

Microsoft has released Update Rollup 8 for Exchange Server 2007 SP3 which contains the below fixes.

• 2699574 Microsoft Exchange Information Store service may stop responding when you perform a search on Exchange mailboxes in an Exchange Server 2007 environment
• 2701037 Events 4999 and 7034 are logged and the Microsoft Exchange Information Store service crashes on an Exchange Server 2007 mailbox server
• 2730089 Microsoft Exchange Information Store service may stop responding when you perform a search on Exchange mailboxes in an Exchange Server 2007 environment
• 2732525 Outlook keeps prompting you for credentials and incorrectly connects to an out-of-site global catalog after you install Update Rollup 6 for Exchange Server 2007 SP3.
• 2740358 MS12-058: Vulnerability in Microsoft Exchange Server WebReady document viewing could allow remote code execution: August 14, 2012

Read about it here

Download it here

Stay tuned for more news about this update at a later point.

Rollup 7 for Exchange 2007 SP3 has been released from Microsoft.

It fixes these issues:

• 2617514 Old spelling rules on the Brazilian Portuguese dictionary in OWA in an Exchange Server 2007 SP3 environment
• 2645789 API_E_NOT_FOUND error when a MAPI application calls the GetProps method on an Exchange Server 2007 mailbox server
• 2654700 Certain mailbox rules do not work automatically after you move a mailbox from an Exchange Server 2007 server to an Exchange Server 2010 server and then move it back
• 2677583 Move operation is not completed and 100 percent of CPU resources are consumed on an Exchange Server 2007 Mailbox server
• 2677979 MSExchangePOP3 service crashes in an Exchange Server 2007 environment
• 2682570 Store.exe crashes on Exchange Server 2007 servers when a public folder that contains an empty PR_URL_NAME property is replicated in a mixed Exchange Server 2007 and Exchange Server 2010 environment
• 2690628 Pre-reform spelling rules are used in the Portuguese (Portugal) dictionary in Outlook Web Access in an Exchange Server 2007 environment
• 2694267 MSExchangeRepl.exe process crashes when Active Directory returns the LDAP_PARAM_ERROR value in an Exchange Server 2007 environment
• 2694274 User who has the Full Access permission cannot open another user’s mailbox by using Outlook Web App in a mixed Exchange Server 2007 and Exchange Server 2010 environment
• 2694291 The autocomplete=”off” parameter is missing in Outlook Web Access in an Exchange Server 2007 environment
• 2696628 You receive duplicate read receipts from a user who is using an IMAP4 client in an Exchange Server 2007 environment

Read about it here at the Exchange product team blog

Download it here