PT-2007-1701 · Microsoft · Exchange Server+1

Published 2007-05-08 · Updated 2020-04-09 · CVE-2007-0220

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2000 SP3, 2003 SP1, and 2003 SP2

Description The issue concerns an information disclosure vulnerability in Microsoft Exchange, specifically in how Outlook Web Access (OWA) handles script-based attachments. This vulnerability allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments. The vulnerability is related to an incorrectly handled UTF character set label.

Recommendations For Microsoft Exchange Server 2000 SP3, consider disabling the handling of script-based attachments in OWA until a fix is available. For Microsoft Exchange Server 2003 SP1 and SP2, restrict access to OWA for attachments that could potentially exploit this issue, and avoid using OWA to open suspicious or untrusted attachments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-0220

Affected Products

Exchange Server

Outlook Web Access

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2007-0220 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0220 · Security Note
• http://securityfocus.com/archive/1/468871/100/200/threaded · Vendor Advisory
• https://docs.microsoft.com/security-updates/securitybulletins/2007/ms07-026 · Note
• http://frsirt.com/english/advisories/2007/1711 · Note
• http://securitytracker.com/id?1018015 · Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026 · Patch, Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0220 · Note
• http://vupen.com/english/advisories/2007/1711 · Note
• http://us-cert.gov/cas/techalerts/TA07-128A.html · Note
• http://osvdb.org/34389 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33887 · Note
• http://securityfocus.com/bid/23806 · Note
• http://kb.cert.org/vuls/id/124113 · Note
• http://secunia.com/advisories/25183 · Note