Vulnerability Note VU#149424

Outlook Web Access (OWA) executes scripts contained in email attachment opened via Microsoft Internet Explorer (IE)

Original Release date: 29 Aug 2001 | Last revised: 30 Aug 2001

Overview

Microsoft Outlook Web Access (OWA) can run malicious scripts on an Exchange server when Internet Explorer (IE) users open email attachments.

Description

OWA allows users to access their email accounts on a Microsoft Exchange server from another host through a web browser. When IE users access their email through some versions of OWA and choose to open an email attachment that contains malicious script in HTML, IE may execute the script on the client side. If executed, the script would have all privileges of the OWA user, including access to and manipulation of messages and folders on the server.

This vulnerability affects OWA implementations in Microsoft Exchange 5.5 and Exchange 2000. Exploitation of this vulnerability requires the user to open an email attachment. This vulnerability applies to all attachments, regardless of the attachment's file type.

Impact

Malicious scripts could access all email messages stored on the server, breaching assumed confidentiality of the messages. Malicious scripts could also delete messages or rearrange messages among folders.

Solution

Download the patch available from Microsoft through its advisory at:
http://www.microsoft.com/technet/security/bulletin/ms01-030.asp

Take great care when choosing whether to open any email attachment. Do not open any email attachment if you are not sure that its content is safe. A malicious attachment may appear to come from someone you trust. Verify that the attachment was sent intentionally by the sender before opening it.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
MicrosoftAffected-05 Jul 2001
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Microsoft for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

  • CVE IDs: CAN-2001-0340
  • Date Public: 06 Jun 2001
  • Date First Published: 29 Aug 2001
  • Date Last Updated: 30 Aug 2001
  • Severity Metric: 0.68
  • Document Revision: 17

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.