Description
Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encapsulation (TNEF) properties, which allows remote attackers to execute arbitrary code via a crafted TNEF message, aka "Memory Corruption Vulnerability."
References (5)
Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/51837
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6114
Vendor Advisory vendor-advisory
x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-003
US Government Resource third-party-advisory
x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA09-041A.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33838
Scores
EPSS
0.2492
EPSS Percentile
97.7%
Details
CWE
CWE-399
Status
published
Products (3)
microsoft/exchange_server
2000 sp3
microsoft/exchange_server
2003 sp2
microsoft/exchange_server
2007 sp1
Published
Feb 10, 2009
Tracked Since
Feb 18, 2026