Microsoft Security Advisory (2401593)

Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability. The following mitigating factors may be helpful in your situation:

• In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker’s Web site.

The following workarounds refer to a setting or configuration change that does not correct the underlying issue but would help limit what an attacker might use the vulnerability to do.

Note These workarounds do not block known attack vectors, but instead help limit how an attacker can exploit the vulnerability by selectively disabling functionality.

• Disable rules by using segmentation

  Segmentation can be performed on a per-server basis to change the functionality of Outlook Web Access. To prevent attackers from exploiting certain features in Outlook Web Access, Administrators may choose to implement segmentation to disable features selectively.

  For information about how to disable rules by using segmentation in Microsoft Exchange Server 2007, see TechNet article, How to Manage Segmentation in Outlook Web Access.

  For information about how to disable rules by using segmentation in Microsoft Exchange Server 2003, see Microsoft Knowledge Base Article 833340.

  Impact of workaround. Disabling rules will prevent an attacker from modifying the user’s rules through OWA, preventing data exfiltration. However, an attacker could still modify a user’s other options. After implementing this workaround, users will no longer be able to create or update rules using OWA. Existing rules will continue to operate. The impact of this workaround only affects functionality in Outlook Web Access, not in an Outlook client.

• Disable the Options panel by using UrlScan

  Implementing this workaround will prevent an attacker from being able to view or modify any Exchange options through OWA, preventing most known attacks against the vulnerability described in this advisory.

  For information about how to disable the Options panel by using UrlScan, see Microsoft Knowledge Base Article 2299129.

  Impact of workaround. Users will no longer be able to modify Exchange options using OWA. Disabling Options also disables rules, as described above. The impact of this workaround only affects functionality in Outlook Web Access, not in an Outlook client.

• Upgrade to a non-affected version of Microsoft Exchange Server

  Microsoft recommends that customers running affected editions of Microsoft Exchange Server upgrade to a non-affected version of Microsoft Exchange Server to address the vulnerability. Microsoft Exchange Server 2007 Service Pack 3 and Microsoft Exchange Server 2010 are not affected by the vulnerability.

• Keep Windows Updated

  All Windows users should apply the latest Microsoft security updates to help make sure that their computers are as protected as possible. If you are not sure whether your software is up to date, visit Windows Update, scan your computer for available updates, and install any high-priority updates that are offered to you. If you have Automatic Updates enabled, the updates are delivered to you when they are released, but you have to make sure you install them.