Microsoft Security Bulletin MS05-029:
Vulnerability in Outlook Web Access for Exchange Server 5.5 Could Allow
Cross-Site Scripting Attacks (895179)
Bulletin URL:
<http://www.microsoft.com/technet/security/Bulletin/MS05-029.mspx>
Version Number: 1.0
Issued Date: Tuesday, June 14, 2005
Impact of Vulnerability: Remote Code Execution Maximum Severity Rating:
Important
Patch(es) Replaced: None
Caveats: None Version Requirements for Dependent Components for This
Update: For this update to be installed successfully, the Microsoft
Outlook Web Access server must have one of the following installed:
* Internet Explorer 5.01 Service Pack 3 installed when using Windows
2000 Service Pack 3
* Internet Explorer 5.01 Service Pack 4 installed when using Windows
2000 Service Pack 4
* Internet Explorer 6 Service Pack 1 installed when using other
supported operating systems Version Recommendations for Dependent
Components on the Outlook Web Access Server: The following versions are
recommended for dependent components on the Outlook Web Access server:
* Microsoft Internet Information Services (IIS):
* IIS 5.0 on Windows 2000 Service Pack 3 or later
* Microsoft Internet Explorer:
* Internet Explorer 6.0 Service Pack 1
Tested Software:
Affected Software:
------------------
* Microsoft Exchange Server 5.5 Service Pack 4 Exchange Server 5.5
Service Pack 4 <http://tinyurl.com/7hg8k>
Technical Description:
----------------------
* Exchange Server Outlook Web Access Vulnerability - CAN-2005-0563: This
is a cross-site scripting vulnerability. The cross-site scripting
vulnerability could allow an attacker to convince a user to run a
malicious script. If this malicious script is run, it would execute in
the security context of the user. Attempts to exploit this vulnerability
require user interaction. This vulnerability could allow an attacker
access to any data on the Outlook Web Access server that was accessible
to the individual user.
This email is sent to NTBugtraq automagically as a service to my
subscribers. (v4.01.1975.38886)
Cheers,
Russ Cooper - Senior Scientist - Cybertrust/NTBugtraq Editor
--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an
Anti-Virus product which automatically notifies the perceived sender of a
message it believes is infected may well cause more harm than good. Someone who
did not actually send you a virus may receive the notification and scramble
their support staff to find an infection which never existed in the first
place. Suggest such notifications be disabled by whomever is responsible for
your AV, or at least that the idea is considered.
--
