Lucene search

[email protected]NVD:CVE-2003-0904

HistoryJan 20, 2004 - 5:00 a.m.

CVE-2003-0904

2004-01-2005:00:00

CWE-200

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.6

Confidence

High

EPSS

0.005

Percentile

77.0%

JSON

Microsoft Exchange 2003 and Outlook Web Access (OWA), when configured to use NTLM authentication, does not properly reuse HTTP connections, which can cause OWA users to view mailboxes of other users when Kerberos has been disabled as an authentication method for IIS 6.0, e.g. when SharePoint Services 2.0 is installed.

Affected configurations

Nvd

Node

microsoftexchange_serverMatch2003-

microsoftsharepoint_servicesMatch2.0

Node

microsoftwindows_server_2003enterprisex64

microsoftwindows_server_2003Match-datacenterx64

microsoftwindows_server_2003Match-standardx64

microsoftwindows_server_2003Match-web

microsoftwindows_server_2003Matchr2x64

VendorProductVersionCPE
microsoftexchange_server2003cpe:2.3:a:microsoft:exchange_server:2003:-:*:*:*:*:*:*
microsoftsharepoint_services2.0cpe:2.3:a:microsoft:sharepoint_services:2.0:*:*:*:*:*:*:*
microsoftwindows_server_2003*cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:enterprise:*:x64:*
microsoftwindows_server_2003-cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:datacenter:*:x64:*
microsoftwindows_server_2003-cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:standard:*:x64:*
microsoftwindows_server_2003-cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:web:*:*:*
microsoftwindows_server_2003r2cpe:2.3:o:microsoft:windows_server_2003:r2:*:*:*:*:*:x64:*

Vendor	Product	Version	CPE
microsoft	exchange_server	2003	cpe:2.3:a:microsoft:exchange_server:2003:-::::::
microsoft	sharepoint_services	2.0	cpe:2.3:a:microsoft:sharepoint_services:2.0:::::::*
microsoft	windows_server_2003	*	cpe:2.3:o:microsoft:windows_server_2003:::::enterprise::x64:
microsoft	windows_server_2003	-	cpe:2.3:o:microsoft:windows_server_2003:-::::datacenter::x64:*
microsoft	windows_server_2003	-	cpe:2.3:o:microsoft:windows_server_2003:-::::standard::x64:*
microsoft	windows_server_2003	-	cpe:2.3:o:microsoft:windows_server_2003:-::::web:::
microsoft	windows_server_2003	r2	cpe:2.3:o:microsoft:windows_server_2003:r2::::::x64:

References

secunia.com/advisories/10615

www.kb.cert.org/vuls/id/530660

www.microsoft.com/exchange/support/e2k3owa.asp

www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0311&L=ntbugtraq&F=P&S=&P=9281

www.securityfocus.com/bid/9118

www.securityfocus.com/bid/9409

docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-002

exchange.xforce.ibmcloud.com/vulnerabilities/13869

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A477

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.6

Confidence

High

EPSS

0.005

Percentile

77.0%

JSON

Related for NVD:CVE-2003-0904

cve1 nessus1 cvelist1 securityvulns1 cert1