PT-2006-2209 · Microsoft · Outlook Web Access+1

Daniel Fabian · Publicado 2006-06-13 · Atualizado 2020-04-09 · CVE-2006-1193

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2000 versions SP1 through SP3

Description The issue is related to a cross-site scripting (XSS) vulnerability when running Outlook Web Access (OWA). It allows remote attackers to inject arbitrary HTML or web script via unknown vectors related to HTML parsing. An attacker could exploit this by constructing an e-mail message with a specially crafted script, which would execute in the security context of the user on the client if run. This requires user interaction.

Recommendations For Microsoft Exchange Server 2000 versions SP1 through SP3, consider disabling Outlook Web Access (OWA) until a patch is available to prevent exploitation of the script injection vulnerability. Restrict access to HTML parsing components to minimize the risk of arbitrary HTML or web script injection. Avoid using OWA for sensitive operations until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2006-1193

Produtos afetados

Exchange Server

Outlook Web Access

Referências · 24

• 🔥 https://exploit-db.com/exploits/28005 · Exploit
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1315 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25550 · Nota
• http://securityfocus.com/bid/18381 · Correção
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1193 · Nota de Segurança
• http://secunia.com/advisories/20634 · Correção
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1315 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-029 · Nota
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1070 · Nota
• http://xforce.iss.net/xforce/xfdb/25550 · Nota
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1161 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1193 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA06-164A.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1193 · Nota
• http://kb.cert.org/vuls/id/138188 · Nota