Microsoft Outlook Web Access redir.asp URI重新定向漏洞
发布日期：2008-10-15 更新日期：2008-11-13 受影响系统： Microsoft Outlook Web Access for Exchange 2003 描述： -------------------------------------------------------------------------------- BUGTRAQ ID: 31765 CVE(CAN) ID: CVE-2008-1547 Micr
发布日期：2008-10-15
更新日期：2008-11-13
受影响系统：
Microsoft Outlook Web Access for Exchange 2003
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 31765
CVE(CAN) ID: CVE-2008-1547
Microsoft Exchange Server是一款流行的邮件服务器，Outlook Web Access是Exchange中用于通过Web浏览器读取和发送邮件的工具。
Outlook Web Access的exchweb/bin/redir.asp页面存在重新定向漏洞，远程攻击者可以在邮件中发送特制的URL，如果用户已经登录的话，则点击该链接就会被立即重新定向到钓鱼网站；如果用户未登录，则点击后会显示登录页面，然后在成功认证后将用户重新定向到钓鱼网站。
链接：http://marc.info/?l=bugtraq&m=122409210619221&w=2
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
https://webmail.example.com/exchweb/bin/redir.asp?URL=http://www.example2.com
https://webmail.example.com/CookieAuth.dll?GetLogon?url=%2Fexchweb%2Fbin%2Fredir.asp%3FURL%3Dhttp%3A%2F%2Fwww.example2.com&reason=0
建议：
--------------------------------------------------------------------------------
厂商补丁：
Microsoft
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
http://www.microsoft.com/technet/security/
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1389
52
What are the benefits of multithreading in c#?
Apr 03, 2025 pm 02:51 PM
The advantage of multithreading is that it can improve performance and resource utilization, especially for processing large amounts of data or performing time-consuming operations. It allows multiple tasks to be performed simultaneously, improving efficiency. However, too many threads can lead to performance degradation, so you need to carefully select the number of threads based on the number of CPU cores and task characteristics. In addition, multi-threaded programming involves challenges such as deadlock and race conditions, which need to be solved using synchronization mechanisms, and requires solid knowledge of concurrent programming, weighing the pros and cons and using them with caution.
Unable to log in to mysql as root
Apr 08, 2025 pm 04:54 PM
The main reasons why you cannot log in to MySQL as root are permission problems, configuration file errors, password inconsistent, socket file problems, or firewall interception. The solution includes: check whether the bind-address parameter in the configuration file is configured correctly. Check whether the root user permissions have been modified or deleted and reset. Verify that the password is accurate, including case and special characters. Check socket file permission settings and paths. Check that the firewall blocks connections to the MySQL server.
How to use sql if statement
Apr 09, 2025 pm 06:12 PM
SQL IF statements are used to conditionally execute SQL statements, with the syntax as: IF (condition) THEN {statement} ELSE {statement} END IF;. The condition can be any valid SQL expression, and if the condition is true, execute the THEN clause; if the condition is false, execute the ELSE clause. IF statements can be nested, allowing for more complex conditional checks.
How to avoid third-party interfaces returning 403 errors in Node environment?
Apr 01, 2025 pm 02:03 PM
How to avoid the third-party interface returning 403 error in the Node environment. When calling the third-party website interface using Node.js, you sometimes encounter the problem of returning 403 error. �...
How to solve the 'Network Error' caused by Vue Axios across domains
Apr 07, 2025 pm 10:27 PM
Methods to solve the cross-domain problem of Vue Axios include: Configuring the CORS header on the server side using the Axios proxy using JSONP using WebSocket using the CORS plug-in
How to efficiently obtain component_verify_ticket in EasyWechat 5.5?
Apr 01, 2025 pm 12:42 PM
Get ComponentVerify in EasyWechat5.5...
How to use Debian Apache logs to improve website performance
Apr 12, 2025 pm 11:36 PM
This article will explain how to improve website performance by analyzing Apache logs under the Debian system. 1. Log Analysis Basics Apache log records the detailed information of all HTTP requests, including IP address, timestamp, request URL, HTTP method and response code. In Debian systems, these logs are usually located in the /var/log/apache2/access.log and /var/log/apache2/error.log directories. Understanding the log structure is the first step in effective analysis. 2. Log analysis tool You can use a variety of tools to analyze Apache logs: Command line tools: grep, awk, sed and other command line tools.
Is there a mac version of mysql
Apr 08, 2025 pm 02:30 PM
Question: Can MySQL run on macOS? Answer: Yes. Specific instructions: It can be installed through the official MySQL installer. You can use Homebrew to install, providing command-line-driven installation methods and dependency management. Create databases and tables using the MySQL command line client. Optimize query performance and understand indexing, query cache and database standardization. Avoid conflicting version issues and use a single installation method. Ensure secure configuration, use strong passwords and access controls.
