XADM: Buffer Overrun in Exchange Server 5.5 LDAP Service

A buffer overrun may occur in the bind function of the Lightweight Directory Access Protocol (LDAP) service in Exchange Server. This could allow specially-malformed bind requests to cause unexpected behavior on the Exchange Server computer. The most common result of a malformed bind request is that the directory service stops unexpectedly, which prevents the server from delivering messages. However, in a more esoteric variant of the attack, a highly-skilled malicious user could exploit the vulnerability to run arbitrary code on the server.

To resolve this problem, obtain the latest service pack for Exchange Server version 5.5. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: The English version of this fix should have the following file attributes or later:

Component: Directory


NOTE: You must apply Exchange Server 5.5 Service Pack 2 before applying this fix.

This hotfix has been posted to the following Internet location as Psp2diri.exe (x86) and Psp2dira.exe (Alpha):

This vulnerability in the directory service is only exposed when the directory service is configured to allow programs to access the directory using LDAP. You can prevent this vulnerability from being exploited by turning off the LDAP protocol support on a server or across a whole Exchange site. In order to do this, start the Microsoft Exchange Server Administrator program and view the properties of the LDAP Protocol object under the Protocols container. Click to clear the Enable Protocol check box.

Customers who require LDAP protocol support and who cannot apply the hotfix can use the following workaround to temporarily address this issue:

• If such an attack causes one or more services to stop, the service failure can be detected by the server monitor feature of the Exchange Server Administrator program. The server monitor can be configured to automatically restart the affected Exchange services if they unexpectedly stop, reducing the impact of the service failure.
• You can prevent this vulnerability from being exploited by filtering incoming data sent through Transmission Control Protocol (TCP) port 389.

Microsoft has confirmed that this is a problem in Microsoft Exchange Server version 5.5. This problem was first corrected in Exchange Server 5.5 Service Pack 3.