XGEN: Incorrect Attachment Processing in Exchange 2000 Outlook Web Access Can Run Script (299535)

SYMPTOMS

OWA is a service of Exchange 2000 Server that a user can use to gain access to an Exchange mailbox by using a Web browser. However, a vulnerability exists in the interaction between OWA and Microsoft Internet Explorer for message attachments. If an attachment contains Hypertext Markup Language (HTML) code that includes script, the script is run when the user opens the attachment, regardless of the attachment type. Because OWA requires that scripting be enabled in the zone where the OWA server is located, this script can take action against the user's Exchange mailbox.

An attacker might use this vulnerability to construct an attachment that contains malicious script code. The attacker can then send the attachment in a message to a user. If the user opens the attachment in OWA, the script runs and can take action against the user's mailbox as if the script is the user, including, under certain circumstances, manipulation of messages or folders.

The following are mitigating factors:

• The vulnerability can only be exploited if the user is using OWA in conjunction with Internet Explorer.
• The vulnerability can only be exploited by attachments that are received by using OWA. In general, an attacker has no way to determine whether a user will open an attachment by using OWA rather than Microsoft Outlook.
• An attacker's ability to exploit this vulnerability requires that the attacker entice the user to open an attachment from an untrusted source. The best practice is not to open any attachment from an unknown or untrusted source.