OWA access to everyones INBOX 2

[achilleus]

Hi all...Just discovered a HUGE hole in my OWA security...It seems that if you log into OWA as yourself, you can then change the name in the address field to some other user and view ALL of their email!...What am I missing that gives everyone access to this?...Is it Exchange or ISS permision?

Any help would be great!...This is a pretty serious security hole...

Thanks! AJ
SA
HS

 

[achilleus]

Also, if it matters, I have a front-end server for OWA access...So maybe its something on there... AJ
SA
HS

 

[hads]

Are you logging on as a normal 'domain user' account or as your account with elevated permissions?
01101000011000010110010001110011

 

[achilleus]

This was reported by a user with normal (ie non admin) rights...I had someone else with domain user rights test it also, and once he logged in to OWA as himself, he could change to any inbox...So its not a admin right issue...

I really need to figure this out before word gets around the office that you can see other peoples email... AJ
SA
HS

 

[tom11011]

Sounds like the permissions are messed up. Go to system manager and find the server in question under Administrative Groups. Right click the server name and choose properties. Select the Security tab. What permissions are set for everyone? Also, are there any groups in there that might contain user objects? What permissions are set for them (if any). Also, are the permissions showing as inherited (ie grayed out).

 

[fluid11]

Can any user open any other users mailbox through Outlook or any other mail client other than OWA?

ChrisP ---------------------------------------
If someone's post was helpful to you, please click the box "Click here to mark this post as a helpful or expert post".

 

[achilleus]

Eeeep...Yep...Even from Outlook you can open anyones Inbox...My permissions must be way off...I'll take a look at the permissions in system manager... AJ
SA
HS

 

[fluid11]

If the Security tab isn't showing in SM, take a look at this...

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q259221

XADM: Security Tab Not Available on All Objects in System Manager (Q259221)


I would imagine that the Security tab is already showing because it sounds like somebody has already gotten to it...


ChrisP ---------------------------------------
If someone's post was helpful to you, please click the box "Click here to mark this post as a helpful or expert post".

 

[achilleus]

Ok...Here are the permisssions under the Exchange server security tab in the system manager:

Authenticated users: None
Domain Admins: Everything but send and recieve as
Everyone: Create Named Properties in the IS

Ok...Wait...the company group has Full Control...Everyone is a member of that one!...What control should that have?...

Am I missing someone?...Like authenticated users?... AJ
SA
HS

 

[fluid11]

What is the "company group"? Is that Domain Users? ---------------------------------------
If someone's post was helpful to you, please click the box "Click here to mark this post as a helpful or expert post".

 

[achilleus]

Yep...Just a group I created with everyone in it...Guess that would be the Domain Users... AJ
SA
HS

 

[fluid11]

Just remove the group from the ACL. You don't need to grant everybody any kind of access to the entire Exchange server, unless there is a special requirement for it. The default permissions are okay, so you can remove this group.

ChrisP ---------------------------------------
If someone's post was helpful to you, please click the box "Click here to mark this post as a helpful or expert post".

 

[achilleus]

Do you think I need to restart the IS service after removing that group? AJ
SA
HS

 

[fluid11]

No, you don't have to. Remove it and let me know if it works. Did you add this group yourself? ---------------------------------------
If someone's post was helpful to you, please click the box "Click here to mark this post as a helpful or expert post".

 

[tom11011]

Wait, was this group added here or is it being inherited from somewhere higher up?

 

[achilleus]

It let me remove it, so I assume it was added there specifically...I removed it....Seemed to do the trick...Now when you try to open another users inbox it says "Unable to display the folder, the Inbox could not be found"...Then if I try it in OWA, it asks for the user name and password...

So seems to be ok now...

THANK YOU SO MUCH!!!!!!! AJ
SA
HS

 

[Rleeunc]

I have the same problem, but for only 1 user in my own IT group. It only occurs in OWA. if I try to get into her mailbox from Outlook 2002, it says access denied. Thanks!! Rlee@ncdoi.net