Check Point Advisories

Microsoft Exchange Server Outlook Web Access Script Injection (MS06-029; CVE-2006-1193)

Vulnerability
Protection

Check Point Reference:	CPAI-2006-252
Date Published:	28 Oct 2009
Severity:	High
Last Updated:	Tuesday 30 July, 2013
Source:
Industry Reference:	CVE-2006-1193
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Microsoft provides server and client side implementations of email protocols such as SMTP, POP3 and IMAP. The widely used Exchange Server product is an implementation of an email server capable of handling most standard Internet protocols as well as numerous proprietary Microsoft protocols and formats. Microsoft Exchange also provides a Webmail implementation that allows for access of mail via HTTP clients. The component that provides this service is called Outlook Web Access. More specifically, Microsoft Exchange Outlook Web Access is a web application that is an alternative to Microsoft Outlook. It allows users to access their email and public folders using a web browser. Outlook Web Access is implemented in ASP and is hosted on a system with the Internet Information Server (IIS) installed. A script injection vulnerability exists in Microsoft Exchange Servers running Outlook Web Access. The vulnerability is caused by improper sanitization of e-mail messages which contain script code when they are read through Outlook Web Access. A malicious user may exploit this flaw to inject and execute HTML and script code in the security context of the target user's browser session. In the case of a successful script injection exploit, arbitrary script code will be executed on a client's browser that is connected to the Exchange Server Outlook Web Access service. The behaviour of the system is dependant on the nature and intention of the injected code. In such a case, the malicious code will be executed in the security context allowed by the client's browser.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Microsoft Exchange Server Outlook Web Access Script Injection (MS06-029) protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: NNTP Protection Violation.
Attack Information: Microsoft Exchange Server Outlook web access script injection (MS06-029)