Microsoft Exchange Server CVE-2015-1764 Same Origin Policy Security Bypass Vulnerability

Bugtraq ID:	75007
Class:	Design Error
CVE:	CVE-2015-1764
Remote:	Yes
Local:	No
Published:	Jun 09 2015 12:00AM
Updated:	Jun 09 2015 12:00AM
Credit:	Microsoft
Vulnerable:
Not Vulnerable:

Microsoft Exchange Server CVE-2015-1764 Same Origin Policy Security Bypass Vulnerability

Microsoft Exchange Server is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass the same-origin policy, obtain sensitive information and perform unauthorized actions. This could be used to steal sensitive information or launch other attacks.

Microsoft Exchange Server CVE-2015-1764 Same Origin Policy Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Exchange Server CVE-2015-1764 Same Origin Policy Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Exchange Server 2013 Cumulative Update 8 0

• Microsoft Security Update For Exchange Server 2013 CU8 (KB3062157)
  https://www.microsoft.com/downloads/details.aspx?FamilyID=210f8d09-35a 0-46ab-9696-846af41364f3

Microsoft Exchange Server 2013 SP1 0

• Microsoft Security Update For Exchange Server 2013 SP1 (KB3062157)
  https://www.microsoft.com/downloads/details.aspx?FamilyID=d2ff4e07-25a 2-4874-b62f-8891156d274a

Microsoft Exchange Server CVE-2015-1764 Same Origin Policy Security Bypass Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Security Bulletin MS15-064 (Microsoft)