PT-2016-2768 · Microsoft · Outlook+1

Published 2016-09-13 · Updated 2018-10-12 · CVE-2016-0138

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2007 SP3 through 2016 Cumulative Update 2

Description The issue is related to the improper parsing of email messages by Microsoft Exchange Server, which can allow a remote attacker to obtain sensitive information from Outlook applications by leveraging the Send As right. This can lead to the disclosure of confidential user information contained in Microsoft Outlook applications.

Recommendations For Microsoft Exchange Server versions 2007 SP3 through 2016 Cumulative Update 2, consider restricting access to the Send As right until a patch is available. As a temporary workaround, consider disabling the use of the Send As command in Outlook applications to minimize the risk of exploitation. Restrict access to sensitive Outlook application information to minimize the risk of information disclosure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-02170

CVE-2016-0138

Affected Products

Exchange Server

Outlook

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2016-0138 · Security Note
• https://bdu.fstec.ru/vul/2016-02170 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0138 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-108 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0138 · Security Note
• http://securityfocus.com/bid/92806 · Note
• http://technet.microsoft.com/security/bulletin/MS16-108 · Note
• http://technet.microsoft.com/library/security/MS16-108 · Note
• http://securitytracker.com/id/1036778 · Note