[NT] Vulnerabilities in Outlook Web Access for Exchange Server Allows Elevation of Privilege (MS08-039)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Vulnerabilities in Outlook Web Access for Exchange Server Allows Elevation
of Privilege (MS08-039)
------------------------------------------------------------------------


SUMMARY

This security update resolves two privately reported vulnerabilities in
Outlook Web Access (OWA) for Microsoft Exchange Server. An attacker who
successfully exploited these vulnerabilities could gain access to an
individual OWA client s session data, allowing elevation of privilege. The
attacker could then perform any action the user could perform from within
the individual client s OWA session.

This security update is rated Important for all supported editions of
Microsoft Exchange Server 2003 and Microsoft Exchange Server 2007. For
more information, see the subsection, Affected and Non-Affected Software,
in this section.

DETAILS

Affected Software:
*
<http://www.microsoft.com/downloads/details.aspx?familyid=E099C1D1-5AF6-4D6C-B735-9599412B3131> Microsoft Exchange Server 2003 Service Pack 2 - Elevation of Privilege - Important - None
*
<http://www.microsoft.com/downloads/details.aspx?familyid=086A2A13-A1DE-4B1D-BD12-B148BFD2DAFA> Microsoft Exchange Server 2007 - Elevation of Privilege - Important - MS07-026
*
<http://www.microsoft.com/downloads/details.aspx?familyid=63E7F26C-92A8-4264-882D-F96B348C96AB> Microsoft Exchange Server 2007 Service Pack 1 - Elevation of Privilege - Important - None

Outlook Web Access for Exchange Server Data Validation Cross-Site
Scripting Vulnerability - CVE-2008-2247
This is a cross-site scripting vulnerability in the affected versions of
Outlook Web Access (OWA) for Exchange Server. Exploitation of the
vulnerability could lead to elevation of privilege on individual OWA
clients connecting to Outlook Web Access for Exchange Server. To exploit
the vulnerability, an attacker would have to convince a user to open a
specially crafted e-mail that would run malicious script from within an
individual OWA client. If the malicious script is executed, the script
would run in the security context of the user s OWA session and could
perform any action the user could perform such as reading, sending, and
deleting e-mail as the logged-on user.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2247>
CVE-2008-2247

Outlook Web Access for Exchange Server HTML Parsing Cross-Site Scripting
Vulnerability - CVE-2008-2248
This is a cross-site scripting vulnerability in the affected versions of
Outlook Web Access (OWA) for Exchange Server. Exploitation of the
vulnerability could lead to elevation of privilege on individual OWA
clients connecting to Outlook Web Access for Exchange Server. To exploit
the vulnerability an attacker would have to convince a user to open a
specially crafted e-mail that would run malicious script from within an
individual OWA client. The script would run in the security context of the
user s OWA session and could perform any action the user could perform,
such as reading, sending, and deleting e-mail as the logged-on user.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2248>
CVE-2008-2248


ADDITIONAL INFORMATION

The information has been provided by Microsoft Product Security.
The original article can be found at:
<http://www.microsoft.com/technet/security/bulletin/ms08-039.mspx>
http://www.microsoft.com/technet/security/bulletin/ms08-039.mspx



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages