Exchange security hole

[danno74]

This is bad...

A company I work with has outlook web access on an Exchange 2000 SP2 server. When they type in that address to get in, like this:

http://ipaddress/exchange/username

Problem is, when you enter in someone else's username at the end of the link, and then the prompt comes up and you enter YOUR username and pass, you can see THEIR inbox! Has anyone seen this before, and if so, how the hell can you stop it?

Thanks.

 

[james3838]

You either have delegated rights or you are using an account that has rights to view that mailbox.

It does not work like that when (default) permissions are set correctly.

 

[danno74]

Thanks for the tip, I have found the culprit. Their IT security group has permission to view all mailboxes. I am trying to remove it, but it keeps giving me the "You cannot remove this object because it is inheriting permissions from it's parent. Turn off the option for inheriting permissions and then try removing again." I would but the window I am in under the mailbox properties, under the Exchange Advanced tab, there is no option as there usually is for security permissions. Any idea as to how I can find this? I have gone under Advanced and looked around and couldn't find anything.

Thanks!

 

[YFronts]

Can you not make yourself the owner under advanced first?
Tell us exactly what MMC you are using to do this then I can compare it.

 

[danno74]

Sorry, i am a novice as far as setting the advanced security settings. What do you mean by making myself the owner, of the mailbox??? What is a MMC?