|
Family: CGI abuses --> Category: infos
Outlook Web anonymous access Vulnerability Scan
Vulnerability Scan Summary Outlook Web anonymous access
Detailed Explanation for this Vulnerability Test
It is possible to browse the information of the OWA server by accessing as an
anonymous user with the following URL:
http://www.example.com/exchange/root.asp?acs=anon
After this access, the anonymous user can search for valid users in the OWA
server and can enumerate all users by accessing the following URL:
http://www.example.com/exchange/finduser/details.asp?obj=XXX
(where XXX is a string of 65 hexadecimal numbers)
Data that can be accessed by an anonymous user
may include: usernames, server names, email name accounts,
phone numbers, departments, office, management relationships...
This information will help a possible hacker to make social
engineering attacks with the knowledge gained. This attack
can be easily automated since, even if direct access to search
is not possible, you only need the cookie given on the anonymous
login access.
Administrators might be interested in consulting
the following URL:
http://support.microsoft.com/support/exchange/content/whitepapers/owaguide.doc
Solution:
Disable anonymous access to OWA. Follow these steps:
1. In Microsoft Exchange Administrator open the Configuration container.
2. Choose Protocols, and then double-click HTTP (Web) Site Settings
3. Unselect the 'Allow anonymous users to access
the anonymous public folders' check box.
4. Select the Folder Shortcuts tab.
5. Remove all folders which are allowed anonymous viewing.
6. Choose OK.
7. Remove the anonymous access from the login web pages.
Threat Level: Medium
Click HERE for more information and discussions on this network vulnerability scan.
|