Microsoft Outlook Web Access XSS (MS08-039)

July 17, 2008 – 12:11 PM

Several Cross Site Scripting vulnerabilities were found in within Outlook Web Access (OWA) 2003/2007. An attacker can craft a malicious email which will trigger within a user’s browser. Different version of OWA and different clients (Light and Premium) have different attack vectors which can result in an attacker gaining *persistent* control over a victim’s use of Outlook Web Access. An attacker would have full control and access to the victims e-mail account. This control could be further abused by utilising techniques such as JavaScript root-kits or web worms.

Source:
http://www.securiteam.com/windowsntfocus/5UP0G20OUE.html