PT-2007-1701 · Microsoft · Exchange Server+1

Publicado 2007-05-08 · Atualizado 2020-04-09 · CVE-2007-0220

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2000 SP3, 2003 SP1, and 2003 SP2

Description The issue concerns an information disclosure vulnerability in Microsoft Exchange, specifically in how Outlook Web Access (OWA) handles script-based attachments. This vulnerability allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments. The vulnerability is related to an incorrectly handled UTF character set label.

Recommendations For Microsoft Exchange Server 2000 SP3, consider disabling the handling of script-based attachments in OWA until a fix is available. For Microsoft Exchange Server 2003 SP1 and SP2, restrict access to OWA for attachments that could potentially exploit this issue, and avoid using OWA to open suspicious or untrusted attachments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-0220

Produtos afetados

Exchange Server

Outlook Web Access

Referências · 16

• https://nvd.nist.gov/vuln/detail/CVE-2007-0220 · Nota de Segurança
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-026 · Nota
• http://frsirt.com/english/advisories/2007/1711 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0220 · Nota de Segurança
• http://securitytracker.com/id?1018015 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026 · Correção, Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0220 · Nota
• http://vupen.com/english/advisories/2007/1711 · Nota
• http://us-cert.gov/cas/techalerts/TA07-128A.html · Nota
• http://securityfocus.com/archive/1/468871/100/200/threaded · Aviso do Fabricante
• http://osvdb.org/34389 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33887 · Nota
• http://securityfocus.com/bid/23806 · Nota
• http://kb.cert.org/vuls/id/124113 · Nota
• http://secunia.com/advisories/25183 · Nota