Microsoft has issued a third version of a security patch for its Exchange Server versions 5.5 and 2000. Intended to plug a security hole that could allow hackers access to mailboxes, Microsoft yesterday said the last, second, patch contained outdated files.
Because of the erroneous fix, the email system could show "performance problems... in certain instances", Microsoft said in a security bulletin.
Redmond's giant had hoped the first security update would get rid of the vulnerability. This was posted exactly a week before the third one on 6 June. After customer complaints the patch was pulled and replaced. But this second patch also caused issues.
Some system administrators said installing the first patch left them with a malfunctioning email system; conventional Outlook clients failed and Outlook Web Access refused service. The second attempt to secure email systems also caused problems.
One administrator, who found his Exchange 2000 Server email system in limbo after he installed the first patch, said he would let others try the new patch before installing it himself.
"I will just wait until service pack one and for a couple of people try it out first," said one network administrator for a US consultancy firm.
The vulnerability exists in the Outlook Web Access module of the Exchange 2000 Server and Exchange 5.5 Server email systems. Using malicious code in an email attachment, a hacker could gain access to users' mailboxes, and could potentially delete messages and folders, Microsoft said.