A patch that Microsoft Corp. released today to fix a critical flaw in its Exchange Server product prevents users from sending e-mail messages from a mobile device or from a shared mailbox in Exchange 2000 Server and in Exchange Server 2003. The patch was released as part of Microsoft's scheduled monthly security updates for May and addresses a flaw in Exchange Server's calendar properties. If exploited, the vulnerability could allow an attacker to execute malicious code on a compromised server.

According to a Microsoft spokesman, the patch for the Exchange vulnerability affects other technologies, such as Research In Motion Ltd.'s BlackBerry and Good Technology Inc.'s GoodLink services. "Any service or user that needs to 'Send As' another user may be affected," the Microsoft spokesman said in en e-mail. "In the past, granting the 'Full Mailbox Access' permission on another mailbox was sufficient to allow you to send as the mailbox owner."

With the update, a user needs to be specifically granted 'Send As' privileges, he said. "If an application service account has relied on 'Full Mailbox Access' alone, the application will be affected," he said.

In a note quoting RIM, the SANS Internet Storm Center in Bethesda, Md., said the update affects user mailbox permissions by revoking the "Send As" permission in Exchange. "Once applied, this update will prevent users on BlackBerry Enterprise Server from sending e-mail from a BlackBerry or BlackBerry-enabled device, however users will still receive e-mails on their BlackBerry device. This is due to the BlackBerry service sending e-mails on behalf of a user when a message is sent via the BlackBerry device," the note said.

The other bulletin addressed a flaw in the Macromedia Flash Player from Adobe Systems Inc. The remote code-execution flaw was previously reported and fixed by Adobe Systems. However, Microsoft redistributes Flash Player, and the patch addresses the issue in Microsoft platforms where the Flash Player is present.