Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted email to an affected Exchange server, triggering an internal content-conversion process. Successful exploitation could allow the attacker to execute code on the server. Exploitation requires an attacker to have a deep understanding of the target environment and is not guaranteed to succeed. User interaction is not required. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to have a deep understanding of the system. Successful exploitation is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures.
<a href="https://x.com/xamroot">Max Toor</a> with Microsoft, <a href="https://smlijun.github.io/">DongJun Kim</a> with UIUC