Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
TitleVulnerabilities in Microsoft Exchange Server Could Allow Elevation of Privilege (3062157)
Informations
NameMS15-064First vendor Publication2015-06-09
VendorMicrosoftLast vendor Modification2015-06-09
Severity (Vendor) ImportantRevision1.0

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score6.8Attack RangeNetwork
Cvss Impact Score6.4Attack ComplexityMedium
Cvss Expoit Score8.6AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Severity Rating: Important
Revision Note: V1.0 (June 9, 2015): Bulletin published.
Summary: This security update resolves vulnerabilities in Microsoft Exchange Server. The most severe of the vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL that takes them to a targeted Outlook Web App site. An attacker would have no way to force users to visit a specially crafted website. Instead, an attacker would have to convince them to visit the website, typically by getting them to click a link in an instant messenger or email message that takes them to the attacker's website, and then convince them to click the specially crafted URL.

Original Source

Url : https://technet.microsoft.com/en-us/library/security/MS15-064

CWE : Common Weakness Enumeration

%idName
50 %CWE-352Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25)
50 %CWE-79Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:29115
 
Oval ID: oval:org.mitre.oval:def:29115
Title: Exchange Cross-Site Request Forgery vulnerability - CVE-2015-1771 (MS15-064)
Description: Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users, aka "Exchange Cross-Site Request Forgery Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2015-1771
Version: 3
Platform(s): Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): Microsoft Exchange Server 2013
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28607
 
Oval ID: oval:org.mitre.oval:def:28607
Title: Exchange Server-Side Request Forgery vulnerability - CVE-2015-1764 (MS15-064)
Description: The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery (SSRF) issue, aka "Exchange Server-Side Request Forgery Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2015-1764
Version: 3
Platform(s): Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): Microsoft Exchange Server 2013
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28928
 
Oval ID: oval:org.mitre.oval:def:28928
Title: Exchange HTML injection vulnerability - CVE-2015-2359 (MS15-064)
Description: Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2015-2359
Version: 3
Platform(s): Microsoft Windows Server 2008 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Product(s): Microsoft Exchange Server 2013
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application2

Nessus® Vulnerability Scanner

DateDescription
2015-06-10Name : The remote Microsoft Exchange server is affected by multiple vulnerabilities.
File : smb_nt_ms15-064.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
DateInformations
2015-06-11 13:27:52
  • Multiple Updates
2015-06-11 00:29:10
  • Multiple Updates
2015-06-10 21:30:45
  • Multiple Updates
2015-06-10 09:30:14
  • Multiple Updates
2015-06-09 21:30:53
  • Multiple Updates
2015-06-09 21:17:40
  • First insertion