Script Execution Vulnerability in Microsoft Exchange Outlook Web Access

Reported June 08, 2001, byMicrosoft.

VERSIONS AFFECTED

DESCRIPTION
Aflaw exists in the interaction between Microsoft Exchange Server Outlook WebAccess (OWA) and Microsoft Internet Explorer (IE) with message attachments. Ifan attachment contains HTML code that includes script, the script will executewhen the user opens the attachment, regardless of the attachment type. BecauseOWA requires that the user enable scripting in the zone where the OWA server islocated, this script can take action against the user’s Exchange mailbox as ifthe script were the user, including modifying and manipulating messages.

VENDOR RESPONSE

Thevendor, Microsoft, has acknowledged thisvulnerability and recommends that users immediately apply the patchmentioned in Security Bulletin MS01-030. 

CREDIT
Discovered by JoaoGouveia.