In July 2012, Microsoft warned administrators that critical vulnerabilities in code it licenses from Oracle could give attackers a way into Exchange Server 2007 and Exchange Server 2010. The same flaws also affected FAST Search Server 2010 for SharePoint. Microsoft published Security Advisory 2737111 on 24 July 2012.
Timeline: from Oracle’s patch to Microsoft’s fix
Oracle’s July 2012 Critical Patch Update fixed the flaws in its Outside In libraries. It was a large release that, according to the coverage of the time, repaired nearly 90 vulnerabilities across Oracle’s products, database software included. Microsoft licenses a custom implementation of those libraries, so Oracle’s fix did not reach Exchange automatically. Microsoft had to issue its own update.
The advisory came on 24 July 2012. Microsoft said it was investigating public reports of vulnerabilities in the third-party code. On 25 July it revised the titles of the workarounds for clarity but left the steps unchanged.
The company did not give a release date for a patch. A Microsoft Security Response Center post said the teams were working on an update “of appropriate quality”. The Security Research & Defense team published a blog with more detail on the workarounds.
On 14 August 2012, Microsoft released bulletin MS12-058, rated critical, for Exchange. The advisory was revised the same day to reflect it. The bulletin said the update fixes the flaws by replacing the affected Oracle Outside In libraries with a non-vulnerable version.
On 9 October 2012, the advisory was updated again after bulletin MS12-067 was published for FAST Search Server 2010 for SharePoint.
How the flaws worked and who was exposed
Exchange uses Outside In for WebReady Document Viewing in Outlook Web App. The feature lets users view supported attachments in a browser without downloading them or opening a locally installed application. The vulnerabilities were in the code that parses those files.
Microsoft said that in the most severe case an attacker could take control of the server process doing the parsing, using a specially crafted file. The attacker could then install programs, view, change or delete data, or do anything else that process was allowed to do.
FAST Search Server was in a better position. A Dark Reading report on the Exchange patch noted Microsoft’s statement that the Outside In functionality there was not enabled by default. It also ran with a restricted token, similar to the Office 2010 Protected View sandbox, which limited what an attacker could reach even after compromising the process.
A Qualys blog post pointed to US-CERT’s list of about 30 other vendors whose products also use the Oracle library, including Cisco, IBM, McAfee and Symantec. It said they should assess their own exposure.
What administrators were told to do
Microsoft said it knew of no active exploits when it issued the advisory. It still recommended that customers with on-premises servers apply the workarounds. For Exchange, that meant turning off WebReady Document Viewing in Outlook Web App. For FAST Search Server, it meant disabling the features that depend on the Outside In libraries.
When MS12-058 arrived, Microsoft said customers who had already applied the Exchange workaround did not need to undo it before installing the update. They could reverse it afterwards if they wanted to bring document viewing back.
When the Exchange patch came out, Dark Reading said the flaws were not known to be under attack. A security specialist it quoted urged that the patch be applied as soon as possible on any system running Exchange and Outlook Web App. He pointed to Outside In’s long record of security problems.
The advisory lists 13 CVE identifiers for the flaws, running from CVE-2012-1766 to CVE-2012-1773 and from CVE-2012-3106 to CVE-2012-3110. CERT tracked the issue as VU#118913.