VULHUB ™

Outlook Web Access ships with Microsoft Exchange 2000 by default. Because of a flaw in the interaction between Outlook Web Access (OWA) and Internet Explorer, it is possible for an email attachment to be executed without prompting the user first. If an email attachment is received by a user (using OWA and IE to retrieve mail), the attachment could be executed without prompting the user with a dialogue requesting the selection of the appropriate application to view the file. Therefore, an HTML attachment containing a script will run without the user's knowledge.

Outlook Web Access ships with Microsoft Exchange 2000 by default. Because of a flaw in the interaction between Outlook Web Access (OWA) and Internet Explorer, it is possible for an email attachment to be executed without prompting the user first. If an email attachment is received by a user (using OWA and IE to retrieve mail), the attachment could be executed without prompting the user with a dialogue requesting the selection of the appropriate application to view the file. Therefore, an HTML attachment containing a script will run without the user's knowledge.