Educause Security Discussion mailing list archives

[SPAM] Does MS Exchange OWA Webready document viewing expose the exchange server to hazards in attachments?


From: Bob Bayn <bob.bayn () USU EDU>
Date: Thu, 11 Jun 2009 11:57:24 -0600

Our enterprise MS Exchange server has the Outlook Web Access (OWA) interface with "WebReady Document Viewing" enabled.  
I read my email in OWA light in Firefox on a Ubuntu Linux box.  So, I see an "Open as Web Page" alternative.  I'm 
trying to determine if that option puts our Exchange server at risk for mischief imbedded in the attachment when it 
opens it to render it as a web page.  Here's a highly suspicious message included below.  Now I suspect that my 
Ubuntu/OpenOffice environment may not be susceptible to whatever payload was in the attachment.  But I wonder if the 
Exchange server might be, if I choose the "Open as Web Page" option.  My googling and reading MS documentation online 
doesn't give me any indication that the possibility has been addressed.

Bob Bayn        (435)797-2396        Security Team coordinator
"Risk comes from not knowing what you're doing" –Warren Buffet
Office of Information Technology    at   Utah State University
________________________________________
From: Lottery Promotions [claimukltt004 () msn com]
Sent: Thursday, June 11, 2009 10:29 AM
Subject: Your email has won you the Sum of USD 1,000,000.00 From Canada Lottery
{attachment: Canada Lottery.doc [Open as Web Page] -removed}

[snip part of the message body]

Pleas View the attached letter and contact our paying agent Dr.Anderson for your lottery Payment

Current thread: