--[ Product: Microsoft Outlook Web Access (OWA) for Exchange 5.5
--[ Severity: High
--[ Description Microsoft Outlook Web Access for Exchange 5.5 (henceforth, "OWA") is vulnerable to HTTP Response Splitting (see "Divide and Conquer: HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics", http://www.sanctuminc.com/pdf/WhitePaper_HTTPResponse.pdf). OWA is vulnerable through several scripts/URLs (in a redirection scenario).
This technique enables the attacker to poison a cache server (de- facto defacing the OWA site), to hijack responses (pages) from other users, to send crafted responses (pages) to other users, and to mount a cross site scripting attack on other users. A user account is needed in order to access the vulnerable scripts. The anonymous (public) account (available by default) can be used to that purpose. Note that if SSL is used between the client (browser) and the OWA site, then web cache poisoning is limited to any cache device that resides on-site, between the OWA server and the SSL termination point.
--[ Solution Microsoft has issued a security bulletin (MS04-026, "Vulnerability in Exchange Server 5.5 Outlook Web Access Could Allow Cross-Site Scripting and Spoofing Attacks (842436)") at the following URL:
