Heads Up: OWA/Exchange 5.5 Users
From BugTraq:
Make sure your anon account is not available
======================
////////////////////////////////////////////////////////////////////
//=====================>> Security Advisory <<====================// ////////////////////////////////////////////////////////////////////
--------------------------------------------------------------------
-----[ Microsoft Outlook Web Access (OWA) for Exchange 5.5
is vulnerable to HTTP Response Splitting attack
--------------------------------------------------------------------
--[ Author: Amit Klein, Sanctum Inc. http://www.SanctumInc.com/
--[ Release Date: August 11th, 2004
--[ Product: Microsoft Outlook Web Access (OWA) for Exchange 5.5
--[ Severity: High
--[ Description
Microsoft Outlook Web Access for Exchange 5.5 (henceforth, "OWA") is vulnerable to HTTP Response Splitting (see "Divide and Conquer: HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics", http://www.sanctuminc.com/pdf/WhiteP...TPResponse.pdf).
OWA is vulnerable through several scripts/URLs (in a redirection scenario).
This technique enables the attacker to poison a cache server (de- facto defacing the OWA site), to hijack responses (pages) from other users, to send crafted responses (pages) to other users, and to mount a cross site scripting attack on other users. A user account is needed in order to access the vulnerable scripts. The anonymous (public) account (available by default) can be used to that purpose. Note that if SSL is used between the client (browser) and the OWA site, then web cache poisoning is limited to any cache device that resides on-site, between the OWA server and the SSL termination point.
--[ Solution
Microsoft has issued a security bulletin (MS04-026, "Vulnerability in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site Scripting and Spoofing Attacks (842436)") at the following URL:
http://www.microsoft.com/technet/sec.../MS04-026.mspx
Information regarding the security update that addresses this problem is available in the bulletin.
=======================
