Exchange 2010 SP3 RU2 has been released to resolve the security issues described in Microsoft Security Bulletin MS13-061.  Additionally Exchange 2007, Exchange 2010 SP2 and Exchange 2013 also received updates to resolve the security issues as mentioned in the MS13-061 bulletin and other product specific fixes.

Click the above image to download, or the direct download link is here.

Exchange 2010 SP3 RU2 is also released as part of Patch Tuesday to resolve the security issues that are addressed in CVE-2013-2393 and CVE-2013-3776.

They are also discussed in the Oracle Critical Patch Update Advisory - July 2013.    Microsoft has classified both of them as critical for Exchange 2010.

This is build 14.03.0158.001 of Exchange 2010, and KB2866475 has the full details for the release.

Some updates of particular note:

• 2863473 Users cannot access Outlook mailboxes that connect to a Client Access server array in an Exchange Server 2010 environment
• 2841150 Cannot change a distribution group that contains more than 1,800 members by using ECP in OWA in an Exchange Server 2010 environment

And it also resolves two transport crash issues that were introduced in Exchange 2010 SP3 RU1

1. 1. 2870028 EdgeTransport.exe crashes when an email message without a sender address is sent to an Exchange Server 2010 Hub Transport server
   2. 2871758 EdgeTransport.exe process consumes excessive CPU resources on an Exchange Server 2010 Edge Transport server

Note that you may be prompted for the Exchange 2010 SP3 installation files when installing Exchange 2010 SP3 RU2.  Specifically it prompts for "exchangeserver.msi.      This does not happen for all installations.  If you are prompted, simply point to the SP3 installation files.

Issues Resolved

• 2837926 Error message when you try to activate a passive copy of an Exchange Server 2010 SP3 database: "File check failed"
• 2841150 Cannot change a distribution group that contains more than 1,800 members by using ECP in OWA in an Exchange Server 2010 environment
• 2851419 Slow performance in some databases after Exchange Server 2010 is running continuously for at least 23 days
• 2853899 Only the first page of an S/MIME signed or encrypted message is printed by using OWA in an Exchange Server 2010 environment
• 2854564 Messaging Records Management 2.0 policy can't be applied in an Exchange Server 2010 environment
• 2855083 Public Folder contents are not replicated successfully from Exchange Server 2003 or Exchange Server 2007 to Exchange Server 2010
• 2859596 Event ID 4999 when you use a disclaimer transport rule in an environment that has Update Rollup 1 for Exchange Server 2010 SP3 installed
• 2860037 iOS devices cannot synchronize mailboxes in an Exchange Server 2010 environment
• 2861118 W3wp.exe process for the MSExchangeSyncAppPool application pool crashes in an Exchange Server 2010 SP2 or SP3 environment
• 2863310 You cannot send an RTF email message that contains an embedded picture to an external recipient in an Exchange Server 2010 SP3 environment
• 2863473 Users cannot access Outlook mailboxes that connect to a Client Access server array in an Exchange Server 2010 environment
• 2866913 Outlook prompts to send a response to an additional update even though the response request is disabled in an Exchange Server 2010 environment
• 2870028 EdgeTransport.exe crashes when an email message without a sender address is sent to an Exchange Server 2010 Hub Transport server
• 2871758 EdgeTransport.exe process consumes excessive CPU resources on an Exchange Server 2010 Edge Transport server
• 2873477 All messages are stamped by MRM if a deletion tag in a retention policy is configured in an Exchange Server 2010 environment

Important Notes

Now, before we rush off to download and install this there are a couple of items to mention!

• Test the update in your lab before installing in production.  If in doubt test…
• If the Exchange server does not have Internet connectivity then this introduces significant delay in building the Native images for the .Net assemblies as the server is unable to get to http://crl.microsoft.com.  To resolve this issue, follow these steps:
  1. On the Tools menu in Windows Internet Explorer, click Internet Options, and then click the Advanced tab.
  2. In the Security section, click to clear the Check for publisher's certificate revocation check box, and then click OK.

  We recommend that you clear this security option in Internet Explorer only if the computer is in a tightly controlled environment. When setup is complete, click to select the Check for publisher’s certificate revocation check box again.

• Update Internet facing CAS servers first
• Backup any OWA customisations as they will be removed
• Test (yes technically this is in here for a second time but it is important!)

Note that you may be prompted for the Exchange 2010 SP3 installation files when installing Exchange 2010 SP3 RU2.  Specifically it prompts for "exchangeserver.msi.      This does not happen for all installations.  If you are prompted, simply point to the SP3 installation files

Cheers,

Rhoderick