Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Outlook Web Access Data Validation Cross-Site Scripting Vulnerability (MS08-039)

Subscribe

Check Point Reference: CPAI-2008-095
Date Published:
Severity:
Last Updated:
Source: Microsoft Security Bulletin MS08-039
Industry Reference(s): CVE-2008-2247
Protection Provided by: VPN-1
  • NGX R65
  • NGX R62
  • NGX R61
  • NGX R60
VSX
  • NGX R65
InterSpect
  • NGX
Connectra
  • NGX R62
  • NGX R61
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Microsoft Exchange Server 2003 SP2
Vulnerability Description
A cross-site scripting vulnerability has been detected in Outlook Web Access. Outlook Web Access (OWA) is a webmail service of Microsoft Exchange Server 5.0 and later. The web interface of OWA resembles the interface in Microsoft Outlook. Cross-site scripting (XSS) could enable an attacker to inject code into a user's session with a Web site. A remote attacker may exploit this vulnerability to gain access to a user’s OWA session data allowing elevation of privilege.
Update/Patch Available
Apply patches:
Microsoft Security Bulletin MS08-039
Vulnerability Details
The vulnerability is a result of OWA failure to properly validating e-mail fields when opening mail from within OWA. An attacker could exploit this vulnerability by sending a specially crafted e-mail message to the victim. Successful exploitation of this issue could allow the attacker to login to the OWA session, leading to elevation of privilege. 

Protection Overview
By enabling this protection, SmartDefense will detect and block the transfer over SMTP of malformed e-mail messages attempting to exploit this vulnerability.

In order for the protection to be activated, update your VPN-1 product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

VPN-1 NGX R65 & R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > SMTP > Block Outlook Web Access Data Validation Vulnerability (MS08-039).
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SMTP Protection Violation
Attack Information: Outlook Web Access data validation vulnerability (MS08-039)

VPN-1 NGX R61 & R60

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > SMTP.
2. Select the following:

Block Outlook Web Access Data Validation Vulnerability (MS08-039)

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SMTP Protection Violation
Attack Information: Outlook Web Access data validation vulnerability (MS08-039)

VPN-1 VSX NGX R65

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > SMTP > Block Outlook Web Access Data Validation Vulnerability (MS08-039).
2. In the configuration pane, under Settings > Mode, check Active.
3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SMTP Protection Violation
Attack Information: Outlook Web Access data validation vulnerability (MS08-039)

InterSpect NGX

How Can I Protect My Network?
1. In the left pane, select Profiles > Default Protection and select the SmartDefense page of the profile.
2. In the SmartDefense tree, click Application Intelligence > SMTP.
3. Select the following protection:

Block Outlook Web Access Data Validation Vulnerability (MS08-039)

4. Install security policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: SMTP Protection Violation
Attack Information: Outlook Web Access data validation vulnerability (MS08-039)

Connectra NGX R62 & R61

How Can I Protect My Network?
1. In the left-hand menu, click Security > SmartDefense > Application Intelligence.
2. In the Dynamic Attacks pane, select the following:

Block Outlook Web Access Data Validation Vulnerability (MS08-039)

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Attack Name: SMTP Protection Violation
Attack Information: Outlook Web Access data validation vulnerability (MS08-039)

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Application Intelligence > SMTP2, and select the User-name String Matching protection group.
3. Click smtp2_usernames:mismatched_angle_bracket_alert (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entry will be logged:

Alert Name: smtp2_usernames
Description: mismatched_angle_bracket_alert