PT-2016-4084 · Microsoft · Exchange Server 2013+3

Published 2016-06-14 · Updated 2018-10-12 · CVE-2016-0028

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 Microsoft Exchange Server 2016 Gold and Cumulative Update 1

Description The issue allows remote attackers to track users via a crafted HTML e-mail message due to improper restriction of loading IMG elements in Outlook Web Access (OWA). An email filter bypass exists in the way Microsoft Exchange parses HTML messages, which could allow information disclosure. If successfully exploited, an attacker could identify, fingerprint, and track a user online if the user views email messages using OWA. The attacker could also combine this issue with another one, such as a Cross-Site Request Forgery (CSRF), to amplify the attack.

Recommendations For Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12, update to a version that properly restricts loading of IMG elements. For Microsoft Exchange Server 2016 Gold and Cumulative Update 1, update to a version that properly restricts loading of IMG elements. As a temporary workaround, consider restricting access to OWA to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-0028

Affected Products

Exchange Server

Exchange Server 2013

Exchange Server 2016

Outlook Web Access

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-0028 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0028 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-079 · Vendor Advisory
• http://securitytracker.com/id/1036106 · Note
• http://technet.microsoft.com/library/security/ms16-079 · Note