14 DAY TRIAL // Microsoft has delivered eight different security bulletins on this month’s Patch Tuesday cycle, three of which have been flagged as critical for all users.
It appears, however, that the Exchange 2013 security update MS13-061 is actually causing lots of issues on specific computers, so the company has decided to pull the bulletin until a fix is found.
According to the company, the issue does not affect Exchange 2010 or Exchange 2007, so the 2013 version of the server software seems to be the only one that won’t work with the update.
“Late last night we became aware of an issue with MS13-061 security update for Exchange Server 2013. Specifically, after the installation of the security update, the Content Index for mailbox databases shows as Failed and the Microsoft Exchange Search Host Controller service is renamed,” Microsoft explains.
“For those that have already installed the MS13-061 security update for Exchange Server 2013, we already have KB 2879739 that provides the steps on how to resolve this issue. However, due to this issue and that it affects all Mailbox server installations, we have decided to pull the MS13-061 security update temporarily.”
Security bulletin MS13-061 is one of the critical updates released by Microsoft on Patch Tuesday, trying to fix three publicly disclosed vulnerabilities in Exchange Server.
The update has been labeled critical for all versions of Microsoft Exchange Server, starting with 2007 Service Pack 3 and ending with 2013. The found vulnerabilities would allow remote code execution and thus enable an attacker to take control of an unpatched machine.
“The vulnerabilities exist in the WebReady Document Viewing and Data Loss Prevention features of Microsoft Exchange Server. The vulnerabilities could allow remote code execution in the security context of the transcoding service on the Exchange server if a user previews a specially crafted file using Outlook Web App (OWA),” Microsoft explained.