Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

Description of the security update for Microsoft Exchange: December 12, 2017


View products that this article applies to.

Summary

This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability could allow elevation of privilege or spoofing in Microsoft Exchange Server if an attacker sends an email message that has a specially crafted attachment to a vulnerable server that is running Exchange Server. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2017-11932 and ADV170023.
 

↑ Back to the top


Improvements and fixes

This security update was released to address a known issue in security update 4036108 in which customers that are using split DNS may encounter problems that affect Calendar Sharing. This update removes the fix for this vulnerability. 

↑ Back to the top


Known issues

  • We are aware of some reports that Exchange services may remain in a disabled state after you install this security update. If this occurs, the update is installed correctly. However, the service control scripts encounter a problem when they try to return Exchange services to its usual state. To resolve this issue, use Services Manager to restore the startup type to Automatic, and then start the affected Exchange services manually.
  • When you try to manually install this security update in "normal mode" (not running the update as an administrator) and by double-clicking the update file (.msp), some files are not correctly updated. When this issue occurs, you do not receive an error message or any indication that the security update is not correctly installed. Also, Outlook Web Access (OWA) and the Exchange Control Panel (ECP) may stop working. This issue occurs on servers that are using UAC (user account control). The issue occurs because the security update does not correctly stop certain Exchange-related services. To avoid this issue, run the security update in elevated mode as an administrator. To do this, right click the update file, and then click Run as administrator.

↑ Back to the top


How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

↑ Back to the top


More Information

Security update deployment information

For deployment information about this update, see security update deployment information: December 12, 2017. 

File hash information

File information

The English (United States) version of this update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time together with your current daylight-saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Security Update For Exchange Server 2016 CU7
Security Update For Exchange Server 2016 CU6
Security Update For Exchange Server 2013 CU17
Security Update For Exchange Server 2013 CU18

↑ Back to the top


Keywords: kbContentAuto, CI68113, kbsurveynew, kbfix, kbnofix, kbsecreview, kbsecbulletin, kbsecvulnerability, atdownload, kbmustloc, kblangall, kbsecurity, security update for exchange server, kb, Known Issues, Known issues, kbexpertiseinter

↑ Back to the top

Article Info
Article ID : 4045655
Revision : 20
Created on : 4/13/2020
Published on : 4/16/2020
Exists online : False
Views : 408