This security update resolves two privately reported vulnerabilities in Outlook Web Access

This security update resolves two privately reported vulnerabilities in Outlook Web Access (OWA) for Microsoft Exchange Server. An attacker who successfully exploited these vulnerabilities could gain access to an individual OWA client’s session data, allowing elevation of privilege. The attacker could then perform any action the user could perform from within the individual client’s OWA session.

This security update is rated Important for all supported editions of Microsoft Exchange Server 2003 and Microsoft Exchange Server 2007. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses the vulnerabilities by modifying the validation of HTTP session data within OWA. For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

Recommendation.  Microsoft recommends that customers apply the update at the earliest opportunity.

Known Issues.  Microsoft Knowledge Base Article 953747 documents the currently known issues that customers may experience when installing this security update.

Related posts:

1. Vulnerabilities does not spare acrobat too
2. Microsoft Corp issued a zero day attack advisory
3. Wordpress Security Update
4. Ajax vulnerabilities
5. Microsoft is warning customers about a zero-day flaw
6. Microsoft Security Advisory Notification - Update for Security Advisory (904420) - Win32/Mywife.E@mm

Related posts brought to you by Yet Another Related Posts Plugin.