From russ.cooper@CYBERTRUST.COM Tue Jun 14 13:59:41 2005 From: "Cooper, Russ" To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM Date: Tue, 14 Jun 2005 13:40:18 -0400 Reply-To: Windows NTBugtraq Mailing List Subject: Alert: Microsoft Security Bulletin MS05-029 - Vulnerability in Outlook Web Access for Exchange Server 5.5 Could Allow Cross-Site Scripting Attacks (895179) Microsoft Security Bulletin MS05-029: Vulnerability in Outlook Web Access for Exchange Server 5.5 Could Allow Cross-Site Scripting Attacks (895179) Bulletin URL: Version Number: 1.0 Issued Date: Tuesday, June 14, 2005 Impact of Vulnerability: Remote Code Execution Maximum Severity Rating: Important Patch(es) Replaced: None Caveats: None Version Requirements for Dependent Components for This Update: For this update to be installed successfully, the Microsoft Outlook Web Access server must have one of the following installed: * Internet Explorer 5.01 Service Pack 3 installed when using Windows 2000 Service Pack 3 * Internet Explorer 5.01 Service Pack 4 installed when using Windows 2000 Service Pack 4 * Internet Explorer 6 Service Pack 1 installed when using other supported operating systems Version Recommendations for Dependent Components on the Outlook Web Access Server: The following versions are recommended for dependent components on the Outlook Web Access server: * Microsoft Internet Information Services (IIS): * IIS 5.0 on Windows 2000 Service Pack 3 or later * Microsoft Internet Explorer: * Internet Explorer 6.0 Service Pack 1 Tested Software: Affected Software: ------------------ * Microsoft Exchange Server 5.5 Service Pack 4 Exchange Server 5.5 Service Pack 4 Technical Description: ---------------------- * Exchange Server Outlook Web Access Vulnerability - CAN-2005-0563: This is a cross-site scripting vulnerability. The cross-site scripting vulnerability could allow an attacker to convince a user to run a malicious script. If this malicious script is run, it would execute in the security context of the user. Attempts to exploit this vulnerability require user interaction. This vulnerability could allow an attacker access to any data on the Outlook Web Access server that was accessible to the individual user. This email is sent to NTBugtraq automagically as a service to my subscribers. (v4.01.1975.38886) Cheers, Russ Cooper - Senior Scientist - Cybertrust/NTBugtraq Editor -- NTBugtraq Editor's Note: Most viruses these days use spoofed email addresses. As such, using an Anti-Virus product which automatically notifies the perceived sender of a message it believes is infected may well cause more harm than good. Someone who did not actually send you a virus may receive the notification and scramble their support staff to find an infection which never existed in the first place. Suggest such notifications be disabled by whomever is responsible for your AV, or at least that the idea is considered. --