Microsoft Security Bulletin MS15-103 - Important
Vulnerabilities in Microsoft Exchange Server Could Allow Information Disclosure (3089250)
Published: September 8, 2015
Version: 1.0
Executive Summary
This security update resolves vulnerabilities in Microsoft Exchange Server. The most severe of the vulnerabilities could allow information disclosure if Outlook Web Access (OWA) fails to properly handle web requests, and sanitize user input and email content.
This security update is rated Important for all supported editions of Microsoft Exchange Server 2013. For more information, see the Affected Software section.
The security update addresses the vulnerabilities by correcting how Microsoft Exchange OWA handles web requests and by helping to ensure that OWA properly sanitizes user input and email content. For more information about the vulnerabilities, see the Vulnerability Information section.
For more information about this update, see Microsoft Knowledge Base Article 3089250.
Affected Software
The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.
| Software | Maximum Security Impact | Aggregate Severity Rating | Updates Replaced* |
|---|---|---|---|
| Microsoft Server Software | |||
| Microsoft Exchange Server 2013 Cumulative Update 8 (3087126) | Information Disclosure | Important | 3062157 in MS15-064 |
| Microsoft Exchange Server 2013 Cumulative Update 9 (3087126) | Information Disclosure | Important | 3062157 in MS15-064 |
| Microsoft Exchange Server 2013 Service Pack 1 (3087126) | Information Disclosure | Important | 3062157 in MS15-064 |
*The Updates Replaced column shows only the latest update in any chain of superseded updates. For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is provided on the Package Details tab).
Update FAQ
Does this update contain any additional security-related changes to functionality?
In addition to the changes that are listed for the vulnerabilities described in this bulletin, this update includes defense-in-depth updates to help improve security-related features.
Severity Ratings and Vulnerability Identifiers
The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the September bulletin summary.
| Vulnerability Severity Rating and Maximum Security Impact by Affected Software | ||||
|---|---|---|---|---|
| Affected Software | Exchange Information Disclosure Vulnerability - CVE-2015-2505 | Exchange Spoofing Vulnerability - CVE-2015-2543 | Exchange Spoofing Vulnerability - CVE-2015-2544 | Aggregate Severity Rating |
| Microsoft Server Software | ||||
| Microsoft Exchange Server 2013 Service Pack 1 (3087126) | Important Information Disclosure | Not applicable | Important Spoofing | Important |
| Microsoft Exchange Server 2013 Cumulative Update 8 (3087126) | Important Information Disclosure | Important Spoofing | Important Spoofing | Important |
| Microsoft Exchange Server 2013 Cumulative Update 9 (3087126) | Important Information Disclosure | Important Spoofing | Important Spoofing | Important |
Vulnerability Information
Exchange Information Disclosure Vulnerability - CVE-2015-2505
An information disclosure vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited the vulnerability could discover stacktrace details.
To exploit the vulnerability, an attacker would have to create a specially crafted web application request and then submit it to a web application. The security update addresses the vulnerability by correcting how Microsoft Exchange OWA handles web requests.
Microsoft received information about the vulnerability through coordinated vulnerability disclosure. When this security bulletin was issued, Microsoft had not received any information to indicate that this vulnerability had been publicly used to attack customers.
Mitigating Factors
Microsoft has not identified any mitigating factors for this vulnerability.
Workarounds
Microsoft has not identified any workarounds for this vulnerability.
Multiple Exchange Spoofing Vulnerabilities
Spoofing vulnerabilities exist in Microsoft Exchange Server when OWA does not properly sanitize specially crafted email. An authenticated attacker could exploit the vulnerabilities by sending a specially crafted email to a user. An attacker could then perform HTML injection attacks on affected systems, and attempt to trick the user into disclosing sensitive information.
To exploit the vulnerabilities, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user via OWA in an attempt to convince the user to click it.
In a web-based attack scenario, an attacker could host a malicious website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the malicious website. The attacker would have to convince the user to visit the malicious website, typically by enticing the user to click a link in either an instant messenger or email message that takes the user to the attacker's malicious website, and then convince the user to interact with content on the malicious website.
The security update addresses the vulnerabilities by helping to ensure that OWA properly sanitizes email content.
The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list:
| Vulnerability title | CVE number | Publicly disclosed | Exploited |
|---|---|---|---|
| Exchange Spoofing Vulnerability | CVE-2015-2543 | No | No |
| Exchange Spoofing Vulnerability | CVE-2015-2544 | No | No |
Mitigating Factors
Microsoft has not identified any mitigating factors for these vulnerabilities.
Workarounds
Microsoft has not identified any workarounds for these vulnerabilities.
Security Update Deployment
For Security Update Deployment information, see the Microsoft Knowledge Base article referenced in the Executive Summary.
Acknowledgments
Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgments for more information.
Disclaimer
The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Revisions
- V1.0 (September 8, 2015): Bulletin published.
Page generated 2015-09-03 17:14Z-07:00.