full-disclosure - Re: MS OWA 2003 Redirection Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 8 Dec 2008 16:50:14 -0500
From: Peter Watkins <peterw@....org>
To: Micheal Cottingham <techie.micheal@...il.com>
Cc: Giuseppe Gottardi <overet@...uritydate.it>, piergiorgio@...asec.org,
	bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Re: MS OWA 2003 Redirection Vulnerability - [MSRC
	7368br]

On Sat, Nov 15, 2008 at 11:36:26AM -0500, Micheal Cottingham wrote:
> I found and reported this back in 2005/2006. Microsoft told me that it
> had been reported previously and that it would be fixed in the next
> release, which I'm guessing they meant 2007. I do not know if they
> have fixed it in Exchange 2007.

Similary, a few years ago (Nov/Dec 2005, I believe) I notified Microsoft 
about some CSRF flaws in OWA 2003. Sending a message, deleting a message, 
and logging out were all vulnerable. An attacker could trick a victim 
into sending an insult to her bosses (that would show up as an "internal"
message) and removing the message from her Sent Items folder. Clearing the 
deleted items folder, or removing a single message from the deleted items 
folder, did not appear to be vulnerable(!). Microsoft said the flaws were 
fixed in Exchange 2007 but I have no way of verifying that.

-Peter

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/