TITLE: Microsoft Outlook Web Access Script Insertion Vulnerability SECUNIA ADVISORY ID: SA15697
VERIFY ADVISORY: http://secunia.com/advisories/15697/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting WHERE: >From remote SOFTWARE: Microsoft Exchange 5.5 http://secunia.com/product/148/ DESCRIPTION: A vulnerability in Microsoft Exchange Server, which can be exploited by malicious people to conduct script insertion attacks. The vulnerability is caused due to insufficient validation of HTML messages in Outlook Web Access. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site when a specially crafted message is viewed. SOLUTION: Apply patch. Microsoft Exchange Server 5.5 (requires Service Pack 4): http://www.microsoft.com/downloads/details.aspx?familyid=08435B77-9F3A-40F5-B13A-A7019CB1C244 ORIGINAL ADVISORY: MS05-029 (KB895179): http://www.microsoft.com/technet/security/bulletin/ms05-029.mspx iDEFENSE: http://idefense.com/application/poi/display?id=261&type=vulnerabilities ============= PCWorks Mailing List ================= Don't see your post? Check our posting guidelines & make sure you've followed proper posting procedures, http://pcworkers.com/rules.htm Contact list owner <[EMAIL PROTECTED]> Unsubscribing and other changes: http://pcworkers.com =====================================================
