Microsoft Exchange Server's Outlook Web Access (OWA) Lets Remote Users Execute Arbitrary Code on the OWA User's Web Browser
|
Updated: Jun 9 2001 14:23 (UTC/GMT)
|
Original Entry Date: Jun 7 2001 00:58 (UTC/GMT)
|
Impact: Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): Microsoft Exchange 2000 Server Outlook Web Access, Exchange 5.5
|
Description: Microsoft reported a vulnerability in the Outlook Web Access (OWA) service of Microsoft Exchange Server that may let remote users execute arbitrary code on the OWA user's web browser. The arbitrary code could manipulate the user's e-mail.
A remote user can send an e-mail message containing a malicious attachment to the target OWA user. If the attachment contains HTML
content and includes a script, the script will be executed automatically and without warning when the OWA user double clicks on
the attachment (using OWA).
It is reported that the interaction between Internet Explorer and OWA contains a flaw that does not
display the normal user verification dialogue box when an attachment is opened. Instead, the attachment will be automatically opened
and, because the file is opened using IE, the browser will parse any script contained in the file.
|
Impact: A remote user could cause arbitrary code to be executed by the OWA user's web browser. This arbitrary code would be capable of taking
any action that the user could take on the mailbox, including adding, editing, or deleting data in the mailbox.
|
Solution: The vendor has issued a patch. See the Vendor URL to obtain the patch.
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms01-030.asp (Links to External Site)
|
Cause: State error
|
Underlying OS: Windows (NT), Windows (2000)
|
Reported By: Microsoft Product Security <secnotif@MICROSOFT.COM>
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 6 Jun 2001 17:30:09 -0700
From: Microsoft Product Security <secnotif@MICROSOFT.COM>
Subject: Microsoft Security Bulletin MS01-030
|
The following is a Security Bulletin from the Microsoft Product Security
Notification Service.
Please do not reply to this message, as it was sent from an unattended
mailbox.
********************************
-----BEGIN PGP SIGNED MESSAGE-----
- ----------------------------------------------------------------------
Title: Incorrect Attachment Handling in Exchange 2000 OWA
Can Execute Script
Date: 06 June 2001
Software: Microsoft Exchange 2000 Server Outlook Web Access
Impact: Run code of attacker's choice
Bulletin: MS01-030
Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS01-030.asp.
- ----------------------------------------------------------------------
Issue:
======
OWA is a service of Exchange 2000 Server that allows users to use a
web
browser to access their Exchange mailbox. However, a flaw exists in
the
interaction between OWA and IE for message attachments. If an
attachment contains HTML code including script, the script will be
executed when the attachment is opened, regardless of the attachment
type. Because OWA requires that scripting be enabled in the zone
where
the OWA server is located, this script could take action against the
user's Exchange mailbox.
An attacker could use this flaw to construct an attachment containing
malicious script code. The attacker could then send the attachment in
a
message to the user. If the user opened the attachment in OWA, the
script would execute and could take action against the user's mailbox
as if it were the user, including, under certain circumstances,
manipulation of messages or folders.
Mitigating Factors:
====================
- The vulnerability could only be exploited if the user were
using OWA in conjunction with IE.
- The vulnerability is only exploitable by attachments that
are received via OWA. In general, an attacker would have
no way to determine whether a user would open an
attachment using OWA rather than an Outlook client.
- An attacker's ability to exploit this vulnerability would
require that she entice the user to open an attachment
from an untrusted source. Best practices recommend against
opening any attachment from an unknown or untrusted source.
Patch Availability:
===================
- A patch is available to fix this vulnerability. Please read the
Security Bulletin
http://www.microsoft.com/technet/security/bulletin/ms01-030.asp
for information on obtaining this patch.
Acknowledgment:
===============
- Joao Gouveia (tharbad@kaotik.org)
- ---------------------------------------------------------------------
THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT
SHALL
MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS
OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR
CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY
NOT
APPLY.
-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.3
iQEVAwUBOx7LEY0ZSRQxA/UrAQEG+gf/YyYGSEvUIavnZrH+1rrj7KBitkI6hY+w
3Ztki4FqGCkE79wdXAcPupRWpfmVmaeY76EFTvWTK3JJtxgf0FbuuelSYoq4Qean
ZfB0RPsRjaK9i5kh0tiaQ+gp/gfXU+hKqIqJKzYb9N+p4RSiw+7l193Xnuu5zgTi
3EWvPwSkZMIVgr9upT1f7rXZXVfB8qZ8bGMh3ukvr9wtCJ/6x0fVEGA3ePBcII9w
9dAt9HZPkVH7ewvnsLYTmHA6Dd66WFP03rAH0hzrJLJgbTKZtlgw+Y5AKdUEjQLU
WmPRKfceWiqW/reA6ZNiObG0/Sn5jU/3Gj4Yt0QS8hchZin//c80bA==
=tYq2
-----END PGP SIGNATURE-----
*******************************************************************
You have received this e-mail bulletin as a result of your registration
to the Microsoft Product Security Notification Service. You may
unsubscribe from this e-mail notification service at any time by sending
an e-mail to MICROSOFT_SECURITY-SIGNOFF-REQUEST@ANNOUNCE.MICROSOFT.COM
The subject line and message body are not used in processing the request,
and can be anything you like.
To verify the digital signature on this bulletin, please download our PGP
key at http://www.microsoft.com/technet/security/notify.asp.
For more information on the Microsoft Security Notification Service
please visit http://www.microsoft.com/technet/security/notify.asp. For
security-related information about Microsoft products, please visit the
Microsoft Security Advisor web site at http://www.microsoft.com/security.
|
|
