Vulnerability Assessment & Network Security Forums

If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.

Home >> Browse Vulnerability Assessment Database >> Windows : Microsoft Bulletins >> Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection (912442)

Vulnerability Assessment Details

Vulnerability in Microsoft Exchange Server Running Outlook Web Access Could Allow Script Injection (912442)

Vulnerability Assessment Summary
Checks for ms06-029 via the registry

Detailed Explanation for this Vulnerability Assessment

Summary :

The remote Web Server contains a script which is vulnerable to script injection
attacks.

Description :

The remote host is running a version of the Outlook Web Access which contains
cross site scripting flaws.

This vulnerability could permit a possible hacker to convince a user
to run a malicious script. If this malicious script is run, it would execute
in the security context of the user.
Attempts to exploit this vulnerability require user interaction.

This vulnerability could permit a possible hacker access to any data on the
Outlook Web Access server that was accessible to the individual user.

It may also be possible to exploit the vulnerability to manipulate Web browser caches
and intermediate proxy server caches, and put spoofed content in those caches.

Solution :

Microsoft has released a patch for OWA for Exchange 2000/2003 :

http://www.microsoft.com/technet/security/bulletin/ms06-029.mspx

Network Security Threat Level:

Low / CVSS Base Score : 1.9
(AV:R/AC:H/Au:NR/C:N/I:P/A:N/B:N)

Networks Security ID: 18381

Vulnerability Assessment Copyright: This script is Copyright (C) 2006-2007 Tenable Network Security

Cables, Connectors