Required CVE Record Information
Description
Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.
References 9 Total
- securityfocus.com: 9409 vdb-entry
- kb.cert.org: VU#530660 third-party-advisory
- oval.cisecurity.org: oval:org.mitre.oval:def:477 vdb-entrysignature
- securityfocus.com: 9118 vdb-entry
- secunia.com: 10615 third-party-advisory
- http://www.microsoft.com/exchange/support/e2k3owa.asp
- exchange.xforce.ibmcloud.com: exchange-owa-account-access(13869) vdb-entry
- docs.microsoft.com: MS04-002 vendor-advisory
- ntbugtraq.com: 20031114 Exchange 2003 OWA major security flaw mailing-list
Updated:
This container includes required additional information provided by the CVE Program for this vulnerability.
References 9 Total
- securityfocus.com: 9409 vdb-entryx_transferred
- kb.cert.org: VU#530660 third-party-advisoryx_transferred
- oval.cisecurity.org: oval:org.mitre.oval:def:477 vdb-entrysignaturex_transferred
- securityfocus.com: 9118 vdb-entryx_transferred
- secunia.com: 10615 third-party-advisoryx_transferred
- http://www.microsoft.com/exchange/support/e2k3owa.asp x_transferred
- exchange.xforce.ibmcloud.com: exchange-owa-account-access(13869) vdb-entryx_transferred
- docs.microsoft.com: MS04-002 vendor-advisoryx_transferred
- ntbugtraq.com: 20031114 Exchange 2003 OWA major security flaw mailing-listx_transferred