MS04-026: Vulnerability in Exchange Server 5.5 Outlook Web Access XSS (842436)
Medium Nessus Plugin ID 14254
SynopsisThe remote web server runs a script vulnerable to cross-site scripting attacks.
DescriptionThe remote host runs Outlook Web Access.
Outlook Web Access is a service for Microsoft Exchange, that provides web-based email, calendaring and contact management to end users.
The remote version of Outlook Web Access is vulnerable to a cross-site scripting attack that could allow an attacker to execute arbitrary java script in the security context of a victim using this service.
To exploit this flaw, an attacker would need to send a specially crafted message to a victim using Outlook Web Access. When the victim reads the message, the bug in Outlook Web Access triggers and cause the execution of the script sent by the attacker.
SolutionMicrosoft has released a set of patches for OWA for Exchange 5.5.