(CIAC Issues Bulletin L-091) Re: Microsoft Exchange 2000 Server's Outlook Web Access (OWA) Lets Remote Users Execute Arbitrary Code on the OWA User's Web Browser
|
|
SecurityTracker Alert ID: 1001710 |
|
SecurityTracker URL: http://securitytracker.com/id/1001710
|
|
CVE Reference:
CAN-2001-0340
(Links to External Site)
|
Date: Jun 8 2001
|
Impact:
Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): Microsoft Exchange 2000 Server Outlook Web Access, Exchange 5.5
|
Description:
Microsoft reported a vulnerability in the Outlook Web Access (OWA) service of Microsoft Exchange Server that may let remote users execute arbitrary code on the OWA user's web browser. The arbitrary code could manipulate the user's e-mail.
A remote user can send an e-mail message containing a malicious attachment to the target OWA user. If the attachment contains HTML content and includes a script, the script will be executed automatically and without warning when the OWA user double clicks on the attachment (using OWA).
It is reported that the interaction between Internet Explorer and OWA contains a flaw that does not display the normal user verification dialogue box when an attachment is opened. Instead, the attachment will be automatically opened and, because the file is opened using IE, the browser will parse any script contained in the file.
|
Impact:
A remote user could cause arbitrary code to be executed by the OWA user's web browser. This arbitrary code would be capable of taking any action that the user could take on the mailbox, including adding, editing, or deleting data in the mailbox.
|
Solution:
The vendor has issued a patch. See the Vendor URL to obtain the patch.
|
Vendor URL: www.microsoft.com/technet/security/bulletin/ms01-030.asp (Links to External Site)
|
Cause:
State error
|
Underlying OS:
Windows (NT), Windows (2000)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 8 Jun 2001 14:49:39 -0700 (PDT)
Subject: CIAC Bulletin L-091 Microsoft Exchange 2000 Server Outlook Web Access Flaw
|
[For Public Release]
-----BEGIN PGP SIGNED MESSAGE-----
__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Center
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Microsoft Exchange 2000 Server Outlook Web Access Flaw
[Microsoft Security Bulletin MS01-030]
June 8, 2001 17:00 GMT Number L-091
______________________________________________________________________________
PROBLEM: A flaw exists in the interaction between Outlook Web Access
(OWA) and Internet Explorer for message attachments. An
attachment containing html code, including script, could
execute when the attachment is opened regardless of the
attachment type.
PLATFORM: Microsoft Exchange 2000 Outlook Web Access
DAMAGE: The flaw could execute script contained in an attachment. An
attacker could construct an attachment containing malicious
code, which would execute if the user opened it.
SOLUTION: Apply the patches as described below.
______________________________________________________________________________
VULNERABILITY The risk is LOW: The vulnerability is only exploitable by
ASSESSMENT: attachments that are received through OWA. It still requires
the user to open an attachment. Users should know not to open
unexpected attachments from any source.
______________________________________________________________________________
[****** Start Microsoft Advisory ******]
http://www.ciac.org/ciac/bulletins/l-091.shtml
[****** End Microsoft Advisory ******]
-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition
iQCVAwUBOyFIELnzJzdsy3QZAQGzUAQA+PTc6o54CvAz89X2TroAlc77RS3v74+Q
rNjFS/e8/iNagPBiN4SYESYz9LTSySQ1JfLfdguWj+t2ul/l7lJLxIvzmD3IWUp6
TNBZ1NzaD29uFmsMaQz2ELich18x8MdvLuSneUaOSSqCI9qn/1Edwx9O4ZDPMWcj
UpY/CCwbChg=
=rUXD
-----END PGP SIGNATURE-----
-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+
This message was posted through the FIRST mailing list server. If you
wish to unsubscribe from this mailing list, send the message body of
"unsubscribe first-info" to first-majordomo@FIRST.ORG
-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+
|
|
