HTTP Response Splitting vulnerability in Microsoft Outlook Web Access for Exchange 5.5
////////////////////////////////////////////////////////////////////
//=====================>> Security Advisory <<====================//
////////////////////////////////////////////////////////////////////
--------------------------------------------------------------------
-----[ Microsoft Outlook Web Access (OWA) for Exchange 5.5
is vulnerable to HTTP Response Splitting attack
--------------------------------------------------------------------
--[ Author: Amit Klein, Sanctum Inc. http://www.SanctumInc.com/
--[ Release Date: August 11th, 2004
--[ Product: Microsoft Outlook Web Access (OWA) for Exchange 5.5
--[ Severity: High
--[ Description
Microsoft Outlook Web Access for Exchange 5.5 (henceforth, "OWA") is
vulnerable to HTTP Response Splitting (see "Divide and Conquer: HTTP
Response Splitting, Web Cache Poisoning Attacks, and Related
Topics", http://www.sanctuminc.com/pdf/WhitePaper_HTTPResponse.pdf).
OWA is vulnerable through several scripts/URLs (in a redirection
scenario).
This technique enables the attacker to poison a cache server (de-
facto defacing the OWA site), to hijack responses (pages) from other
users, to send crafted responses (pages) to other users, and to
mount a cross site scripting attack on other users.
A user account is needed in order to access the vulnerable scripts.
The anonymous (public) account (available by default) can be used to
that purpose.
Note that if SSL is used between the client (browser) and the OWA
site, then web cache poisoning is limited to any cache device that
resides on-site, between the OWA server and the SSL termination
point.
--[ Solution
Microsoft has issued a security bulletin (MS04-026, "Vulnerability
in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site
Scripting and Spoofing Attacks (842436)") at the following URL:
http://www.microsoft.com/technet/security/Bulletin/MS04-026.mspx
Information regarding the security update that addresses this
problem is available in the bulletin.