Vulnerability Note VU#111947
Microsoft Exchange Outlook Web Access fails to authenticate users when searching the Global Address List
Microsoft Exchange servers that offer the Outlook Web Access service are vulnerable to an information disclosure vulnerability that can reveal any email address stored in the Global Address List.
The Outlook Web Access (OWA) component of Microsoft Exchange allows users to access their email with a web browser, obviating the need for a standalone email client. This functionality is implemented with several ASP scripts that allow users to perform typical tasks such as reading, composing, and managing mail messsages. Most of these functions require users to authenticate to the application, thereby protecting the content of the messages. However, the ASP script used by OWA to search the Global Address List (GAL) does not require authentication, which presents an information disclosure vulnerability. By writing custom ASP scripts that bypass the authenticated components of OWA, it is possible for an attacker to learn any email address stored within the GAL.
Attackers can exploit this vulnerability to perform unauthenticated searches on sensitive contact information. For example, an attacker could obtain a user's email address by searching on their name.
Apply a patch from your vendor
Microsoft has released a patch to address this vulnerability; For more information, please consult the vendor information section below.
Disable Outlook Web Access
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Microsoft||Affected||22 Aug 2001||12 Sep 2001|
CVSS Metrics (Learn More)
The CERT/CC thanks Joseph Steinberg of Whale Communications for reporting this vulnerability.
This document was written by Jeffrey P. Lanza.
- CVE IDs: CAN-2001-0660
- Date Public: 06 Sep 2001
- Date First Published: 12 Sep 2001
- Date Last Updated: 12 Sep 2001
- Severity Metric: 6.62
- Document Revision: 10
If you have feedback, comments, or additional information about this vulnerability, please send us email.