PT-2004-1173 · Microsoft · Sharepoint Services 2.0+3

Matthew Johnson · Published 2004-01-08 · Updated 2020-04-09 · CVE-2003-0904

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Exchange 2003 Outlook Web Access (OWA)

Description The issue arises when Microsoft Exchange 2003 and Outlook Web Access (OWA) are configured to use NTLM authentication. In such cases, the software does not properly reuse HTTP connections. This can lead to a situation where OWA users may inadvertently view the mailboxes of other users. The problem is particularly pronounced when Kerberos has been disabled as an authentication method for IIS 6.0, a scenario that can occur when SharePoint Services 2.0 is installed.

Recommendations For Microsoft Exchange 2003, consider re-enabling Kerberos authentication for IIS 6.0 to mitigate the risk. For Outlook Web Access (OWA), restrict access to sensitive mailboxes until a proper fix is applied. As a temporary workaround, consider disabling NTLM authentication and switching to a different authentication method until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2003-0904

Affected Products

Iis 6.0

Exchange 2003

Outlook Web Access

Sharepoint Services 2.0

References · 11

• http://microsoft.com/exchange/support/e2k3owa.asp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0904 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002 · Vendor Advisory
• http://kb.cert.org/vuls/id/530660 · Note
• http://ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13869 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0904 · Note
• http://securityfocus.com/bid/9118 · Note
• http://secunia.com/advisories/10615 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A477 · Note
• http://securityfocus.com/bid/9409 · Note