The Microsoft Exchange Team has announced new update releases for all current versions of Exchange Server. The updates include:
- Exchange Server 2013 Cumulative Update 7
- Exchange Server 2010 SP3 Update Rollup 8 (currently withdrawn due to an issue)
- Exchange Server 2007 SP3 Update Rollup 15
Also included are UM Language Packs for Exchange 2013 CU7.
Important Security Update MS14-075
Included in these update releases is the fix for MS14-075 which resolves four vulnerabilities relating to Outlook Web App, the worst of which could allow elevation of privilege.
The fix is included with Exchange 2010 SP3 UR8 and Exchange 2007 SP3 UR15, and is available as a standalone security update for Exchange 2013 SP1 and Exchange 2013 CU6.
The fix is not provided for any other versions of Exchange Server which may be vulnerable, as they are unsupported.
Improvements in Exchange Server 2013 Cumulative Update 7
Microsoft calls out the following improvements in CU7 for Exchange 2013:
Exchange Server 2013 Cumulative Update 7 includes updates which make migrating to Exchange Server 2013 easier. These include:
- Support for Public Folder Hierarchies in Exchange Server 2013 which contain 250,000 public folders
- Improved support for OAB distribution in large Exchange Server 2013 environments
Customers with Public Folders deployed in an environment where multiple Exchange versions co-exist will want to read Brian Day’s post for additional information.
Improvements in Backup for Exchange Server 2013
CU7 also included a minor improvement (what we might also consider a bug fix) in the area of backup. In Microsoft’s words:
We encourage all customers who backup their Exchange databases to upgrade to Cumulative Update 7 as soon as possible and complete a full backup once the upgrade has been completed. These improvements remove potential challenges restoring a previously backed up database.
This sounds a bit scary (nobody wants to hear that their backups may be unusable for restores) but Microsoft assures us that the condition they are referring to is an edge case only, identified in internal testing, and has not been known to impact production customers.
Obviously you should still follow their advice and take a full backup after your CU7 deployment.
Deploying the Latest Exchange Server Updates
For Exchange Server 2013:
For Exchange Server 2010:
- How to Install Updates on Exchange Server 2010 Database Availability Groups
- How to Install Updates on Exchange Server 2010 CAS Arrays
Recommendations and Known Issues
I frequently receive questions about whether to wait or deploy when new updates are released. My general rule is to wait two weeks to allow time for testing and reviewing any other real world feedback from others, unless circumstances require an urgent deployment (eg for critical security or bug fixes).
- Exchange Server 2013 environments – too early to tell. Important security update should be reviewed. Backup issue should be taken seriously if no restore tests have been performed in your environment previously.
- Exchange Server 2013/Office 365 Hybrid – too early to tell. Refer to notes above for Exchange 2013 concerns. Office 365 Hybrid customers are required to deploy the most current CU release on-premises.
- Exchange Server 2010 environments – Currently withdrawn from the Download Center due to an issue with the update causing Outlook connectivity problems.
- Exchange Server 2007 environments – too early to tell. Important security update should be reviewed. Recent update quality has been good. Test and deploy.
This article New Updates Released for Exchange Server 2013, 2010 and 2007 is © 2014 ExchangeServerPro.com
Get more Exchange Server tips at ExchangeServerPro.com
