|
|
BugTraq
Re: Re: MS OWA 2003 Redirection Vulnerability - [MSRC 7368br] Nov 12 2008 08:59PM Giuseppe Gottardi (overet securitydate it) (1 replies) Re: MS OWA 2003 Redirection Vulnerability - [MSRC 7368br] Nov 15 2008 10:33AM Piergiorgio Venuti (piergiorgio gigasec org) (2 replies) RE: MS OWA 2003 Redirection Vulnerability - [MSRC 7368br] Nov 17 2008 03:59PM Castigliola, Angelo (ACastigliola UNUM COM) Re: [Full-disclosure] MS OWA 2003 Redirection Vulnerability - [MSRC 7368br] Nov 15 2008 04:36PM Micheal Cottingham (techie micheal gmail com) (1 replies) |
|
Privacy Statement |
> I found and reported this back in 2005/2006. Microsoft told me that it
> had been reported previously and that it would be fixed in the next
> release, which I'm guessing they meant 2007. I do not know if they
> have fixed it in Exchange 2007.
Similary, a few years ago (Nov/Dec 2005, I believe) I notified Microsoft
about some CSRF flaws in OWA 2003. Sending a message, deleting a message,
and logging out were all vulnerable. An attacker could trick a victim
into sending an insult to her bosses (that would show up as an "internal"
message) and removing the message from her Sent Items folder. Clearing the
deleted items folder, or removing a single message from the deleted items
folder, did not appear to be vulnerable(!). Microsoft said the flaws were
fixed in Exchange 2007 but I have no way of verifying that.
-Peter
[ reply ]