PT-2017-12228 · Microsoft · Exchange Server

Ck01 · Published 2017-09-12 · Updated 2017-09-21 · CVE-2017-11761

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2013 through 2016

Description The issue is related to an input sanitization problem that could lead to unintended information disclosure. An attacker who successfully exploits this could identify the existence of internal network addresses from a client on the Internet, potentially using this information as part of a larger attack.

Recommendations For Microsoft Exchange Server 2013, update to a version that includes the fix for this issue. For Microsoft Exchange Server 2016, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive network information to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-11761

Affected Products

Exchange Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-11761 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11761 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11761 · Vendor Advisory
• http://securitytracker.com/id/1039320 · Note
• http://securityfocus.com/bid/100731 · Note