PT-2006-2209 · Microsoft · Outlook Web Access+1

Daniel Fabian · Published 2006-06-13 · Updated 2020-04-09 · CVE-2006-1193

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2000 versions SP1 through SP3

Description The issue is related to a cross-site scripting (XSS) vulnerability when running Outlook Web Access (OWA). It allows remote attackers to inject arbitrary HTML or web script via unknown vectors related to HTML parsing. An attacker could exploit this by constructing an e-mail message with a specially crafted script, which would execute in the security context of the user on the client if run. This requires user interaction.

Recommendations For Microsoft Exchange Server 2000 versions SP1 through SP3, consider disabling Outlook Web Access (OWA) until a patch is available to prevent exploitation of the script injection vulnerability. Restrict access to HTML parsing components to minimize the risk of arbitrary HTML or web script injection. Avoid using OWA for sensitive operations until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-1193

Affected Products

Exchange Server

Outlook Web Access

References · 24

• 🔥 https://exploit-db.com/exploits/28005 · Exploit
• http://securityfocus.com/bid/18381 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1193 · Security Note
• http://secunia.com/advisories/20634 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-1193 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-029 · Vendor Advisory
• http://securitytracker.com/id?1016280 · Patch
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1315 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25550 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1315 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2006/ms06-029 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1070 · Note
• http://xforce.iss.net/xforce/xfdb/25550 · Note
• http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1161 · Note
• http://us-cert.gov/cas/techalerts/TA06-164A.html · Note