CVE-2007-0039: Null Pointer Dereference

Published May 8, 2007

Updated

The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which triggers a NULL pointer dereference and an unhandled exception.

Affected Software

4 affected components

Microsoft Exchange Server=2000-sp3

Microsoft Exchange Server=2003-sp1

Microsoft Exchange Server=2003-sp2

Microsoft Exchange Server=2007

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026

Event History

May 8, 2007

CVE Published

11:19 PM

May 9, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0039?

CVE-2007-0039 is classified as a denial of service vulnerability that can crash the Microsoft Exchange Server.

How do I fix CVE-2007-0039?

To mitigate CVE-2007-0039, it is recommended to apply the latest patches provided by Microsoft for the affected Exchange Server versions.

What versions of Microsoft Exchange Server are affected by CVE-2007-0039?

CVE-2007-0039 affects Microsoft Exchange Server 2000 SP3, 2003 SP1, 2003 SP2, and 2007.

Can CVE-2007-0039 be exploited remotely?

Yes, CVE-2007-0039 can be exploited remotely via specially crafted Internet Calendar (iCal) files.

What can happen if CVE-2007-0039 is successfully exploited?

If exploited, CVE-2007-0039 can lead to a denial of service, causing the Exchange Server to crash and become non-responsive.