Incorrect Attachment Handling in Exchange OWA Can Execute Script New

A security vulnerability exists is Outlook Web Access which could allow a malicious user to run the code of their choice.

Issue

OWA is a service of Exchange 5.5 and 2000 Server that allows users to use a web browser to access their Exchange mailbox. However, a flaw exists in the interaction between OWA and IE for message attachments. If an attachment contains HTML code including script, the script will be executed when the attachment is opened, regardless of the attachment type. Because OWA requires that scripting be enabled in the zone where the OWA server is located, this script could take action against the user’s Exchange mailbox.

An attacker could use this flaw to construct an attachment containing malicious script code. The attacker could then send the attachment in a message to the user. If the user opened the attachment in OWA, the script would execute and could take action against the user’s mailbox as if it were the user, including, under certain circumstances, manipulation of messages or folders.

Affected Products

• Microsoft Exchange 5.5 and 2000

Solution

A software patch for Exchange may be downloaded from the following locations:

• Microsoft Exchange Server 5.5
• Microsoft Exchange Server 2000

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: June 8, 2001

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<