Microsoft on Wednesday issued a security alert about a newly discovered flaw in its Exchange 2000 e-mail software that could allow hackers to cripple e-mail servers.
The vulnerability, which Microsoft classified as "critical," affects e-mail servers running Exchange 2000.
Malformed messages created using RFC 821 and 822, versions of the SMTP format commonly used by e-mail programs, can cause the CPU of the server receiving the message to run at 100 percent as it attempts to read the message. The result would be a denial-of-service attack, with the affected server unable to do anything until it finishes processing the message.
Christopher Budd, security program manager at Microsoft's security response center, said the flaw was assigned a "critical" rating because once the attack starts, it can't be stopped, even if Exchange is restarted or the server rebooted.
|