Well, in case you haven’t seen it, an Exchange Security advisory was released today.
“Vulnerabilities in Microsoft Exchange and FAST Search Server 2010 for SharePoint Parsing Could Allow Remote Code Execution”
http://technet.microsoft.com/en-us/security/advisory/2737111
And yes, it also affects the Exchange 2013 Preview.
It wasn’t immediately obvious to me, but every Exchange CAS/CAFE has these libraries installed. Microsoft licenses them from Oracle.
I’m guessing that that will change the workaround to:
Get-OwaVirtualDirectory |? {
$_.OwaVersion -eq ‘Exchange2007’ -or $_.OwaVersion -eq ‘Exchange2010’ –or $_.OwaVersion –eq ‘Exchange2013’ } |
Set-OwaVirtualDirectory -WebReadyDocumentViewingOnPublicComputersEnabled:$False `
-WebReadyDocumentViewingOnPrivateComputersEnabled:$False
But I’m on the road and don’t have access to my E15 test lab at the moment…
Thanks to Susan Bradley, the SBS Diva, for pointing out to me that this doesn’t require third party add-ins.
[Edit]
More information:
“In Microsoft Exchange Server 2007 and Exchange Server 2010, Outlook Web App (OWA) users are provided with a feature called WebReady Document Viewing that allows users to view certain attachments as a web page instead of relying on local applications to open/view it. Oracle Outside In is used by the conversion process in the server backend to support the WebReady feature. Microsoft licenses this library from Oracle.”
In the Exchange Server 2007/2010 scenario, the conversion process that uses Oracle Outside In, TranscodingService.exe, runs as LocalService.
http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx