CVE-2003-0904 Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users w...
MediumCVSS 6.0
EPSS 8.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft exchange server | = 2003 | No fix listed |
| Microsoft sharepoint services | = 2.0 | No fix listed |
| Microsoft windows server 2003 | All versions | No fix listed |
| Microsoft windows server 2003 | = r2 | No fix listed |
References
- 10615 third-party-advisory
- VU#530660 third-party-advisory us-government-resource
- www.microsoft.com patch vendor-advisory
- 20031114 Exchange 2003 OWA major security flaw mailing-list third-party-advisory
- 9118 third-party-advisory vdb-entry
- 9409 third-party-advisory vdb-entry
- MS04-002 patch vendor-advisory
- exchange-owa-account-access(13869) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:477 signature third-party-advisory vdb-entry