| VID |
26089 |
| Severity |
30 |
| Port |
139,445 |
| Protocol |
TCP |
| Class |
SMB |
| Detailed Description |
The Hotfix(KB842436) for 'Cross-Site Scripting and Spoofing Attacks in Exchange Server 5.5
Outlook Web Access' has not been applied.
Outlook Web Access, a service of Microsoft Exchange Server, is vulnerable to a cross-site scripting and spoofing vulnerability, caused by a fail to properly validate input that is provided to a HTML redirection query before it sends this input to the browser.An attacker could create an e-mail message that is specially crafted to attempt to exploit this vulnerability. A remote attacker could exploit the vulnerability by sending this specially crafted e-mail message to the target user of a server that is running Outlook Web Access for Exchange Server 5.5 and then persuading the target user to click a link in the e-mail message. This vulnerability could allow an attacker access to any data on the Outlook Web Access server that was accessible to the individual user. It could also be possible to exploit the vulnerability to manipulate Web browser caches and intermediate proxy server caches, and put spoofed content in those caches. This update replaces the security update that is provided in Microsoft Security Bulletin MS03-047.
* Note: This check requires an account with Guest or upper privileges which can access the registry of the remote host to scan. Absence of these condition will result in the check not being performed and a False Negative for all vulnerable hosts.
* References:
http://www.microsoft.com/technet/security/bulletin/ms04-026.mspx
* Softwares Affected:
Microsoft Exchange Server 5.5 SP4
Outlook Web Access(OWA) |
| Recommendation |
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS04-026, http://www.microsoft.com/technet/security/bulletin/ms04-026.mspx
Users who have customized any of the ASP pages that are listed in the File Information section in this document should back up those files before they apply this update because those ASPs will be overwritten when the update is applied. Any customizations would then have to be reapplied to the new ASP pages.
-- OR --
Patches for Windows platforms are also available from the Microsoft Windows Update Web site, http://windowsupdate.microsoft.com . Windows Update detects what version of Windows you are running and offers the appropriate patch. |
| Related URL |
CVE-2004-0203 (CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
