bugtraq - HTTP Response Splitting vulnerability in Microsoft Outlook Web Access for Exchange 5.5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 11 Aug 2004 10:02:06 +0300
From: Amit Klein <amit.klein@...ctuminc.com>
To: bugtraq@...urityfocus.com
Subject: HTTP Response Splitting vulnerability in Microsoft Outlook Web Access
 for Exchange 5.5

////////////////////////////////////////////////////////////////////
//=====================>> Security Advisory <<====================//
////////////////////////////////////////////////////////////////////

--------------------------------------------------------------------
-----[ Microsoft Outlook Web Access (OWA) for Exchange 5.5
       is vulnerable to HTTP Response Splitting attack
--------------------------------------------------------------------

--[ Author: Amit Klein, Sanctum Inc. http://www.SanctumInc.com/

--[ Release Date: August 11th, 2004

--[ Product: Microsoft Outlook Web Access (OWA) for Exchange 5.5

--[ Severity: High

--[ Description
Microsoft Outlook Web Access for Exchange 5.5 (henceforth, "OWA") is
vulnerable to HTTP Response Splitting (see "Divide and Conquer: HTTP
Response Splitting, Web Cache Poisoning Attacks, and Related
Topics", http://www.sanctuminc.com/pdf/WhitePaper_HTTPResponse.pdf).
OWA is vulnerable through several scripts/URLs (in a redirection
scenario).

This technique enables the attacker to poison a cache server (de-
facto defacing the OWA site), to hijack responses (pages) from other
users, to send crafted responses (pages) to other users, and to
mount a cross site scripting attack on other users.
A user account is needed in order to access the vulnerable scripts.
The anonymous (public) account (available by default) can be used to
that purpose.
Note that if SSL is used between the client (browser) and the OWA
site, then web cache poisoning is limited to any cache device that
resides on-site, between the OWA server and the SSL termination
point.

--[ Solution
Microsoft has issued a security bulletin (MS04-026, "Vulnerability
in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site
Scripting and Spoofing Attacks (842436)") at the following URL:

http://www.microsoft.com/technet/security/Bulletin/MS04-026.mspx

Information regarding the security update that addresses this
problem is available in the bulletin.