PT-2015-2029 · Microsoft · Exchange Server

Published 2015-09-08 · Updated 2018-10-12 · CVE-2015-2505

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2013 Cumulative Update 8 through 2013 Cumulative Update 9 and 2013 SP1

Description The issue is related to the lack of protection for service data in the Outlook Web Access component of Microsoft Exchange Server. This can be exploited by a remote attacker using a specially crafted request to gain access to protected information. The vulnerability allows attackers to obtain sensitive stacktrace information, which could include details about the system's internal workings. An attacker would need to create a specially crafted web application request to exploit this issue.

Recommendations For Microsoft Exchange Server 2013 Cumulative Update 8, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2013 Cumulative Update 9, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2013 SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Outlook Web Access component until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-11375

CVE-2015-2505

Affected Products

Exchange Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2015-2505 · Security Note
• https://bdu.fstec.ru/vul/2015-11375 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2505 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-103 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS15-103 · Note
• http://technet.microsoft.com/security/bulletin/ms15-103 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2505 · Note
• http://securitytracker.com/id/1033495 · Note