Description
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
References
- 9409 vdb-entry
- VU#530660 third-party-advisory
- oval:org.mitre.oval:def:477 vdb-entry signature
- 9118 vdb-entry
- 10615 third-party-advisory
- http://www.microsoft.com/exchange/support/e2k3owa.asp
- exchange-owa-account-access(13869) vdb-entry
- MS04-002 vendor-advisory
- 20031114 Exchange 2003 OWA major security flaw mailing-list