CVE-2003-0904

Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.

CVSS v2.0 6.0 MEDIUM

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281	Third Party Advisory
http://www.microsoft.com/exchange/support/e2k3owa.asp	Patch Vendor Advisory
http://www.securityfocus.com/bid/9118	Third Party Advisory VDB Entry
http://www.kb.cert.org/vuls/id/530660	Third Party Advisory US Government Resource
http://secunia.com/advisories/10615	Third Party Advisory
http://www.securityfocus.com/bid/9409	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/13869	Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A477	Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002	Patch Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:exchange_server:2003:-::::::
	cpe:2.3:a:microsoft:sharepoint_services:2.0:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:microsoft:windows_server_2003:::::enterprise::x64:
	cpe:2.3:o:microsoft:windows_server_2003:-::::datacenter::x64:*
	cpe:2.3:o:microsoft:windows_server_2003:-::::standard::x64:*
	cpe:2.3:o:microsoft:windows_server_2003:-::::web:::
	cpe:2.3:o:microsoft:windows_server_2003:r2::::::x64:

Information

Published : 2004-01-19 21:00

Updated : 2020-04-09 06:49

NVD link : CVE-2003-0904

Mitre link : CVE-2003-0904

JSON object : View

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

Products Affected

microsoft

windows_server_2003
sharepoint_services
exchange_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281", "name": "20031114 Exchange 2003 OWA major security flaw", "tags": ["Third Party Advisory"], "refsource": "NTBUGTRAQ"}, {"url": "http://www.microsoft.com/exchange/support/e2k3owa.asp", "name": "http://www.microsoft.com/exchange/support/e2k3owa.asp", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/9118", "name": "9118", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.kb.cert.org/vuls/id/530660", "name": "VU#530660", "tags": ["Third Party Advisory", "US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://secunia.com/advisories/10615", "name": "10615", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/9409", "name": "9409", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13869", "name": "exchange-owa-account-access(13869)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A477", "name": "oval:org.mitre.oval:def:477", "tags": ["Third Party Advisory"], "refsource": "OVAL"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002", "name": "MS04-002", "tags": ["Patch", "Vendor Advisory"], "refsource": "MS"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2003-0904", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2004-01-20T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:microsoft:exchange_server:2003:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:microsoft:sharepoint_services:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:enterprise:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:datacenter:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:standard:*:x64:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:web:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_server_2003:r2:*:*:*:*:*:x64:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-04-09T13:49Z"}