Unauthenticated Users Can View the Global Address List New

An information disclosure vulnerability exists in the Exchange Server 5.5 Outlook Web Access (OWA) service that could allow an Internet-based attacker to learn the e-mail addresses of users on the server.

Issue

The vulnerability does not allow the attacker to read, write, or change any of the users' e-mail, or to take any other action against the users. The vulnerability also does not allow the attacker to gain any privileges on the server. The vulnerability's sole effect is to allow the attacker to learn the e-mail names of users on the server.

Outlook Web Access (OWA) in Exchange 5.5 offers the ability to search the global address list (GAL). By design, this is an authenticated function, implemented as a two-tier architecture - a front tier that provides a user interface and a back-end tier that actually performs the search. However, only the front tier actually checks authentication. An attacker who sent a properly formatted request to the back-end function that actually performs the search could enumerate the GAL without authenticating.

Affected Products

• Microsoft Exchange 5.5

Download

Patch: http://www.microsoft.com/Downloads/Release.asp?ReleaseID=32483

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: September 6, 2001

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<