PT-2016-2768 · Microsoft · Outlook+1

Publicado 2016-09-13 · Atualizado 2018-10-12 · CVE-2016-0138

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2007 SP3 through 2016 Cumulative Update 2

Description The issue is related to the improper parsing of email messages by Microsoft Exchange Server, which can allow a remote attacker to obtain sensitive information from Outlook applications by leveraging the Send As right. This can lead to the disclosure of confidential user information contained in Microsoft Outlook applications.

Recommendations For Microsoft Exchange Server versions 2007 SP3 through 2016 Cumulative Update 2, consider restricting access to the Send As right until a patch is available. As a temporary workaround, consider disabling the use of the Send As command in Outlook applications to minimize the risk of exploitation. Restrict access to sensitive Outlook application information to minimize the risk of information disclosure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2016-02170

CVE-2016-0138

Produtos afetados

Exchange Server

Outlook

Referências · 9

• http://securityfocus.com/bid/92806 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0138 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-02170 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS16-108 · Nota
• https://osv.dev/vulnerability/CVE-2016-0138 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0138 · Nota de Segurança
• http://technet.microsoft.com/library/security/MS16-108 · Nota
• http://securitytracker.com/id/1036778 · Nota