For the fourth time in over a year, Exchange OWA has put our internal network at risk due to a remote code execution flaw that exists on the server runtime. This risk is compounded by the fact Microsoft won't support OWA in the DMZ.
The issue has to do with the CAS server's (also known as Outlook Web App / OWA) "Outside in" DLLs. These are the files that parse PDFs and Word email attachments into HTML documents for HTML based preview. I would compare this exploit to a server-side buffer overflow triggered by simply sending an email to an unsuspecting recipient.
According to this Microsoft's patch history, the webready sub-component isn't fairing too well security-wise with all these patches in a two year period:
Note these files are developed by Sun/Oracle and the alerts were public long before Microsoft made these public. This list may not be all inclusive, therefore a greater liability is implied.
Is there any deployment guidance of Exchange Server that recommends disabling Webready as a part of the security guidance?
When did the security guidance (above, if it exists) get updated with the most recent advice?
The reason I'm asking is because Exchange is no longer supported in a DMZ or front-end backend configuration. This means that any breach of OWA might breach my internal network. (localservice mitigations aside)
The second reason I'm asking is so I can identify the most forward thinking, or most security conscious methodology that pertains to Exchange. If such a thought-leader exists, I want to subscribe to their blog, purchase their consulting, etc. Basically I want to be ahead of the curve and close whatever other security gaps may exist. I want to know what other components should I disable.