Microsoft plans critical patches for IE, Exchange

Microsoft Corp. today said it will deliver four security updates on Tuesday, two of them pegged "critical," and will finally issue a patch for SQL Server that it's been working on since last April.

The four updates detailed in the advance notice published today will quash bugs in Internet Explorer 7 (IE7); its Exchange mail server software; the Visio application that's part of the Office lineup; and SQL Server. The IE and Exchange vulnerabilities will be labeled critical, the company's highest threat ranking, while the SQL Server and Visio bugs will be marked as "important," one step lower.

That bug is notable for several reasons. When Micosoft confirmed the vulnerability in a Dec. 22 advisory, it noted that exploit code had been published. Several days later, the company admitted that it first received a report on the bug from Bernhard Mueller of SEC Consult Security, a Vienna-based security consulting company, in April 2008.

"Three of these are all equally important, at least with the information we have today," Storms said about the IE, Exchange and SQL Server patches. "It all depends on an enterprise's infrastructure."

Companies are always sensitive to Exchange fixes, Storms continued, so the critical fix set for Exchange Server 2007, 2003 and 2000 will be parsed carefully. "Messaging is so important to the enterprise," Storms said, "that they'll want to spend a little extra time making sure the patch works." One plus, he said, is a "Does not require restart" note by Microsoft in today's bulletin.

"That could mean it's not necessarily a giant hole, or that we're just going to get lucky," said Storms. Because they won't have to restart their Exchange servers, IT administrators should be able to deploy the patch more quickly, he said.

"The IE vulnerability has to be something unique to IE7," wagered Storms. According to Microsoft, the critical vulnerability affects only that version of the browser, not IE6 or IE5.01, the latter edition specific to Windows 2000, and the oldest browser that the company still supports with security updates. Storms hesitated to guess what IE7-only issue might be patched. "It could be any number of things," he said. "Could be scripting or the antiphishing filter."

Microsoft's advance notice reported that the IE7 bug will be rated critical for both Windows XP and Windows Vista, but only "moderate" on Server 2003 and Server 2008.

Microsoft will release February's four updates at approximately 1 p.m. EST Tuesday.

Source: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9127438

Gaps found in Microsoft Exchange API documentation

Zarafa Chief Executive Brian Joseph--having ported, as he put it, "all the Exchange features to the Linux platform with full MAPI, said there are significant gaps in the Microsoft documentation released to date. Zarafa makes an e-mail server that is compatible with Outlook

Speaking to ZDNet UK at the CeBIT conference, Joseph said Microsoft's start is not promising: "This could definitely make life easier for developers, but we have spotted over 200 undocumented exceptions, including one that allows you to create recurring calendar appointments in Exchange. It was in the documentation for Exchange 2000, but they forgot to document it for Exchange 2003 and Exchange 2007."

Zarafa produces the eponymous e-mail server that runs on Linux and is used by enterprises such as car-rental company Sixt, which recently migrated its entire e-mail server infrastructure to Zarafa. Zarafa uses the MAPI open standard to communicate to e-mail clients such as Outlook. While Microsoft Exchange uses MAPI too, it also uses a large number of proprietary APIs that let the Outlook client perform actions such as creating recurring calendar appointments on the Exchange server.

"I am very positive about unconditional publication of APIs," said Joseph, "but only time will tell if this is justified, given Microsoft's history. I think hundreds of thousands of developers around the world are very interested in full publication with regular updates, but the devil is in the detail; for policy makers, these gaps in the Exchange documentation should put another light on the value of Microsoft's announcement."

Zimbra Vice President John Robb agreed that Microsoft's announcement is a good move, but again expressed reservations. His company produces the Zimbra Collaboration Suite, which also runs on Linux platforms and servers. The Zimbra Collaboration suite runs 11 million mailboxes through the commercial version of its product and many more through the open-source version.

"The MAPI protocol is open anyway, so that doesn't affect us directly," Robb said, "but we are concerned that Microsoft has not announced which APIs have patent conditions, nor what those conditions are. We're anxiously awaiting details."

Source: http://news.cnet.com/Gaps-found-in-Microsoft-Exchange-API-documentation/2100-7344_3-6233802.html?tag=nw.3

How To: Recreate OWA Virtual Directory - Exchange 2007

How To: Recreate OWA Virtual Directory - Exchange 2007. So many times I heard that OWA doesn’t work on Exchange 2007 server. There would be many reason behind it, like permission configuration, missing files, not able to load properly, .net errors etc…

There are different solutions base on various reasons but no one works then you may try by recreating OWA virtual directory which is giving problem.

Check and note the settings of directory in EMC before recreating it, like InternalURL, ExternalURL, Forms-Based Authentication settings ect..

Procedure:

• First step is to identify the directory which is giving the problem.

You can use Get-OwaVirtualDirectory to get the list of virtual directories.

• Now let’s say I have problem while accessing owa directory. Remove it with below command.

Remove-OwaVirtualDirectory “owa (Default Web Site)”

• Now create it again with below command.

New-OwaVirtualDirectory -OwaVersion “Exchange2007″ -Name “owa (Default Web Site)”

Note: if you are recreating other than owa directory which are legacy Exchange directories then you need to use “Exchange2003or2000″ in OWAVersion switch instead of “Exchange2007″

• Now configure the “owa” virtual directory settings like InternalURL, ExternalURL, Forms-Based Authentications etc… & check the OWA by logging with some test users.

Source: exchangeshare.wordpress.com/2008/07/16/how-to-recreate-owa-virtual-directory-exchange-2007