Microsoft Exchange Outlook Web Access HTTP Response Splitting Vulnerability

Bugtraq ID:	10902
Class:	Input Validation Error
CVE:	CVE-2004-0203
Remote:	Yes
Local:	No
Published:	Aug 10 2004 12:00AM
Updated:	Jul 12 2009 06:16AM
Credit:	Discovery is credited to Amit Klein.
Vulnerable:	Microsoft Exchange Server 5.5 SP4 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0
Not Vulnerable:

Microsoft Exchange Outlook Web Access HTTP Response Splitting Vulnerability

Microsoft Exchange Outlook Web Access (OWA) is prone to HTTP response splitting attacks.

This issue could permit hostile script to be injected into client sessions, which could gain access to properties of the OWA server and Web pages hosted on the site.

It is noted that the attacker must authenticate to OWA to be in a position to exploit this issue. If successfully exploited, this could allow for various attacks, such as session hijacking, and content spoofing. This issue could also be used to exploit latent vulnerabilities in Web client software.

Microsoft Exchange Outlook Web Access HTTP Response Splitting Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Exchange Outlook Web Access HTTP Response Splitting Vulnerability

Solution:
Microsoft has released a Security Bulletin that includes fixes to address this issue.


Microsoft Exchange Server 5.5 SP4

• Microsoft Security Update for Exchange 5.5 (KB842436)
  http://www.microsoft.com/downloads/details.aspx?FamilyId=66E4E033-5A4C -4EEC-84F1-31F0CA878092&displaylang=en

Microsoft Exchange Outlook Web Access HTTP Response Splitting Vulnerability

References:

• Divide and Conquer - HTTP Response Splitting, Web Cache Poisoning Attacks, and R (Sanctum Inc.)
  
• Microsoft Security Bulletin MS04-026 (Microsoft)
  
• HTTP Response Splitting vulnerability in Microsoft Outlook Web Access (Amit Klein )