PT-2005-1166 · Microsoft · Exchange Server+2

Published 2005-02-08 · Updated 2019-04-30 · CVE-2005-0044

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Windows versions prior to the fixed version Exchange Server versions 5.0 through 2003

Description The issue is related to the OLE component, which does not properly validate the lengths of messages for certain OLE data. This allows remote attackers to execute arbitrary code.

Recommendations For Windows versions prior to the fixed version, update to a version that includes the fix for the issue. For Exchange Server versions 5.0 through 2003, consider disabling the OLE component as a temporary workaround until a patch is available.

Fix

Related Identifiers

CVE-2005-0044

Affected Products

Exchange Server

Ole

Windows

References · 10

• http://kb.cert.org/vuls/id/927889 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-0044 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3568 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1180 · Note
• http://us-cert.gov/cas/techalerts/TA05-039A.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19109 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2917 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0044 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4499 · Note