Microsoft Exchange Server OWA could allow unauthorized email account access
| exchange-owa-account-access (13869) |  Medium Risk |
Description:
Microsoft Exchange Server, when using the Outlook Web Access (OWA), could allow a remote authenticated attacker to gain unauthorized access to a victim's email account. If Microsoft Windows SharePoint Services is installed on a system running Microsoft Windows Server and Microsoft Exchange Server, the Kerberos authentication in Internet Information Services (IIS) is disabled, which would result in improper handling of OWA requests to the vulnerable Exchange Server.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS04-002. See References.
As a workaround re-enable and properly configure Kerberos authentication in IIS. See Microsoft Windows Server Support Article dated November 25, 2003 for details.
References:
- BugTraq Mailing List, Tue Nov 25 2003 - 21:38:59 CST: Re: Exchange 2003 OWA major security flaw.
- CIAC Information Bulletin O-052: Microsoft Vulnerability in Exchange Server 2003 Could Lead to Privilege Escalation.
- Microsoft Security Bulletin MS04-002: Vulnerability in Exchange Server 2003 Could Lead to Privilege Escalation (832759).
- Microsoft Windows Server Support Article November 25, 2003: Exchange 2003 and Outlook Web Access Issue.
- NTBugTraq Mailing List, Fri Nov 14 2003 - 21:23:59 CST : Exchange 2003 OWA major security flaw.
- BID-9118: Microsoft Exchange Server 2003 Outlook Web Access Lowered Security Settings Weakness
- BID-912: Microsoft CIS IMAP Buffer Overflow Vulnerability
- BID-9409: Microsoft Exchange Server 2003 Outlook Web Access Random Mailbox Access Vulnerability
- CVE-2003-0904: Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
- SA10615: Microsoft Exchange 2003 May Provide Access to Wrong Mailbox
- US-CERT VU#530660: Microsoft Exchange Server 2003 fails to assign user credentials to proper mailbox
Platforms Affected:
- Microsoft Exchange Server 2003
Reported:
Nov 14, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net