Microsoft Plugs 'Critical' E-Mail Server Holes
Microsoft Corp. on Tuesday released two security bulletins to fix "critical" flaws in several widely deployed products, including one that presents a remote unauthenticated attack vector that could leave corporate e-mail servers open to a destructive network worm attack. A company spokesperson flagged MS06-003 as the most serious issue, warning that a bug in the way TNEF (Transport Neutral Encapsulation Format) is decoded can allow malicious hackers to inject harmful code automatically without user interaction.
Businesses running Microsoft Exchange Server 5.0, Microsoft Exchange Server 5.5 and Microsoft Exchange 2000 are at the highest risk of a network attack, according to Stephen Toulouse, program manager in the MSRC (Microsoft Security Response Center).
