Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » Microsoft Outlook Web Access HTTP Response Splitting Vulnerability

Microsoft Outlook Web Access HTTP Response Splitting Vulnerability

by Nikola Strahija on August 12th, 2004 Microsoft Outlook Web Access for Exchange 5.5 is vulnerable to HTTP Response Splitting.


Amit Klein

Microsoft Outlook Web Access (OWA) for Exchange 5.5 is vulnerable to HTTP Response Splitting attack

--[ Author: Amit Klein, Sanctum Inc. http://www.SanctumInc.com/
--[ Release Date: August 11th, 2004
--[ Product: Microsoft Outlook Web Access (OWA) for Exchange 5.5
--[ Severity: High

--[ Description
Microsoft Outlook Web Access for Exchange 5.5 (henceforth, "OWA") is vulnerable to HTTP Response Splitting (see "Divide and Conquer: HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics", http://www.sanctuminc.com/pdf/WhitePaper_HTTPResponse.pdf). OWA is vulnerable through several scripts/URLs (in a redirection scenario).

This technique enables the attacker to poison a cache server (de- facto defacing the OWA site), to hijack responses (pages) from other users, to send crafted responses (pages) to other users, and to mount a cross site scripting attack on other users.

A user account is needed in order to access the vulnerable scripts. The anonymous (public) account (available by default) can be used to that purpose.

Note that if SSL is used between the client (browser) and the OWA site, then web cache poisoning is limited to any cache device that resides on-site, between the OWA server and the SSL termination point.

--[ Solution
Microsoft has issued a security bulletin (MS04-026, "Vulnerability in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site Scripting and Spoofing Attacks (842436)") at the following URL:

http://www.microsoft.com/technet/security/Bulletin/MS04-026.mspx

Information regarding the security update that addresses this problem is available in the bulletin.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »