Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Where can I find a list of un-patched CVEs for a specific piece of software?

MS Exchange 2003 is no longer supported by Microsoft since April 2009.

However the Exchange 2003 server that I currently have is working just fine for me.
Is there a list of exploits in Exchange 2003 that are not patchable, so that I can make an informed decision on whether I need to upgrade urgently or not?

Links to unofficial patches to fix holes after the last security pack are also much appreciated.

share|improve this question

marked as duplicate by Iszi, AviD Feb 23 '12 at 17:41

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Correction: Exchange 2003 ends mainstram support 4/14/09, and Extended Support for SP3 ends 4/8/14 See this link: – LamonteCristo Feb 23 '12 at 18:10

One of the problems with unsupported software is that you simply don't know. Not only there is nobody to fix security bugs, but there's usually nobody to even collect and disseminate vulnerability reports. The problem becomes much worse with closed-source software.

I think it would be difficult to find issues, let alone create and distribute unofficial fixes. But even if someone were to spend time finding bugs in this old product, and they are kind enough to publish an unofficial fix. How would you be able to trust that this fix is genuine and doesn't introduce a trojan into your system? With nobody accountable or at a position of authority, it's hard to know who to trust.

That said, there's still a large number of people still using Internet Explorer 6, despite warnings that it is insecure, unsupported, and generally a really bad browser :)

share|improve this answer

Here the list of all known exploits from Secunia:
Exchange 2003 has 13 advisories, 1 of which has not been patched.

Here's the link to the unpatched hole:

The NVD database produces 22 entries on a search for exchange 2003 (although not all of these are holes in Exchange 2003 itself (some are holes in Outlook requiring exchange to be involved)) nvd search for exchange 2003

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.