1. Conducting e-mail Security Assessments Dan Elder Security Engineer Novacoast Eron Howard Manager Development Services Novacoast

2. © March 22, 2004 Novell Inc. 2 Novacoast, Inc. Company Facts Founded in 1996 Based in Santa Barbara, California Named Novell “Partner of the Year” for 2002 Professional Services company with practice areas that have been built around key engineers who specialize in a given technology Offices in California, Utah, Arizona, Texas and Oregon National resource for Novell Consulting Receiving our fourth Novell Service Excellence Award

3. © March 22, 2004 Novell Inc. 3 Introduction Published Vulnerabilities for Exchange and Groupwise Auto execution of code Site redirection Hex obfuscation Attacks on Antivirus systems Novacoast security assessments Credits and sources

4. © March 22, 2004 Novell Inc. 4 Published Vulnerabilities in Groupwise 2004-02-11: Novell Groupwise Webaccess Cross Site Scripting Vulnerability 2003-08-01: Novell GroupWise Wireless Webaccess Insecure Logged Password Vulnerability 2003-04-16: Novell GroupWise WebAccess Information Disclosure Vulnerability 2003-04-16: Novell Groupwise Mail Transport Agent Unspecified Denial Of Service Vulnerability 2003-02-20: Novell GroupWise WebAccess Unspecified Malicious Script Vulnerability 2002-07-25: Novell GroupWise Internet Agent Buffer Overflow Vulnerability 2002-02-28: Novell GroupWise Web Root Disclosure Vulnerability 2002-02-21: Novell GroupWise 6 Post Office LDAP Authentication Bypass Vulnerability 2002-01-31: Novell Groupwise Servlet Gateway Default Authentication Vulnerability 2001-10-16: Novell Groupwise Arbitrary File Retrieval Vulnerability 2001-08-15: Novell GroupWise Padlock Vulnerability 2001-08-15: Novell Groupwise Directory Disclosure Vulnerability 2001-02-14: Novell GroupWise Network Directory Browsing Vulnerability 1999-12-19: Novell GroupWise GWWEB.EXE Multiple Vulnerabilities

5. © March 22, 2004 Novell Inc. 5 Published Vulnerabilities in Exchange Exchange 2003-12-16:Microsoft Outlook Web Access HTML Attachment Script Execution Vulnerability 2003-10-23:Microsoft Exchange Server 5.5 Outlook Web Access Cross-Site Scripting Vulnerability 2003-10-22:Microsoft Exchange Server Buffer Overflow Vulnerability 2003-09-15:Microsoft Exchange Server SMTP HELO Argument Buffer Overflow Vulnerability 2003-02-12:Microsoft Exchange Server 5.5 IMAP NOOP Denial of Service Vulnerability 2002-07-25:Microsoft Exchange Server IMC EHLO Response Buffer Overflow Vulnerability 2002-07-12:Microsoft IIS SMTP Service Encapsulated SMTP Address Vulnerability 2002-04-25:Microsoft Remote Procedure Call Service DoS Vulnerability 2002-03-28:Microsoft Outlook Web Access with RSA SecurID Authentication Bypass Vulnerability 2002-03-20:Microsoft Windows SMTP Service Authorization Bypass Vulnerability 2001-12-08:Microsoft OWA Server Embedded Script Execution Vulnerability 2001-09-07:Microsoft Exchange OWA Global Address List Disclosure Vulnerability 2001-08-27:Microsoft Outlook Web Access Denial of Service Vulnerability 2001-07-17:Microsoft Exchange 5.5 LDAP Denial of Service Vulnerabilities 2001-06-13:Microsoft Exchange OWA Embedded Script Execution Vulnerability 2000-10-31:Microsoft Exchange Server Invalid MIME Header charset = "" DoS Vulnerability Outlook 2000-06-05:Microsoft Outlook / Exchange Blank Headers DoS Vulnerability 1999-08-06:NT Exchange Server Encapsulated SMTP Address Vulnerability 1999-06-01:Multiple Vendor PKCS#1 Vulnerability 1999-06-01:Microsoft Exchange Server AUTH / XAUTH / AUTHINFO DoS Vulnerabilities 1999-06-01:Microsoft Exchange Server Empty MIME Boundary DoS 2004-02-02:Multiple Browser URI Display Obfuscation Weakness 2003-09-02:Microsoft mshtml.dll Library GIF Image Handling Denial of Service Vulnerability 2004-02-20:Multiple Outlook/Outlook Express Predictable File Location Weaknesses 2004-02-10:Microsoft Internet Explorer Double-Null URI Denial Of Service Vulnerability 2004-03-11:Microsoft Outlook Mailto Parameter Quoting Zone Bypass Vulnerability 2004-02-20:Multiple Outlook/Outlook Express Predictable File Location Weaknesses 2004-02-10:Microsoft Internet Explorer Double-Null URI Denial Of Service Vulnerability 2003-10-04:Microsoft Internet Explorer Absolute Position Block Denial Of Service Vulnerability 2003-09-02:Microsoft mshtml.dll Library GIF Image Handling Denial of Service Vulnerability 2003-01-22:Microsoft Outlook 2002 V1 Exchange Server Security Certificate Information Leakage Vulnerability 2002-12-04:Microsoft Outlook 2002 Email Header Processing Denial of Service Vulnerability 2002-04-26:Microsoft Outlook HTML Mail Script Execution Vulnerability 2002-04-09:Microsoft VBScript ActiveX Word Object Denial Of Service Vulnerability 2002-03-22:Microsoft Outlook Disabled Cookies Setting Bypass Vulnerability 2002-03-22:Microsoft Outlook IFrame Embedded Media Player File Vulnerability 2002-03-21:Microsoft Outlook Javascript Execution Vulnerability 2002-03-21:Microsoft Outlook IFrame Embedded URL Vulnerability 2001-08-17:Microsoft Outlook Arbitrary Code Execution Vulnerability 2001-07-13:Microsoft Outlook Unauthorized Email Access Vulnerability 2004-02-20:Multiple Outlook/Outlook Express Predictable File Location Weaknesses 2003-09-02:Microsoft mshtml.dll Library GIF Image Handling Denial of Service Vulnerability 2003-02-28:Microsoft Outlook and Outlook Express Arbitrary Program Execution Vulnerability 2003-02-10:Multiple Vendor Email Client JavaScript Information Leakage Vulnerability 2002-04-26:Microsoft Outlook HTML Mail Script Execution Vulnerability 2002-04-09:Microsoft VBScript ActiveX Word Object Denial Of Service Vulnerability 2002-03-22:Microsoft Outlook Disabled Cookies Setting Bypass Vulnerability 2002-03-21:Microsoft Outlook Javascript Execution Vulnerability 2002-03-21:Microsoft Outlook IFrame Embedded URL Vulnerability 2001-08-17:Microsoft Outlook Arbitrary Code Execution Vulnerability 2001-08-15:Microsoft MSHTML.DLL Crash Vulnerability 2001-07-13:Microsoft Outlook Unauthorized Email Access Vulnerability 2001-06-05:Microsoft Outlook Express Address Book Spoofing Vulnerability 2001-03-11:Microsoft Outlook vcard Buffer Overflow Vulnerability 2001-02-27:Microsoft Outlook Vcard DoS Vulnerability 2001-01-22:Microsoft Outlook Concealed Attachment Vulnerability 2000-08-24:Microsoft Outlook Rich Text Format Information Disclosure Vulnerability 2000-07-20:Microsoft Outlook / Outlook Express Cache Bypass Vulnerability 2000-07-18:Microsoft Outlook / Outlook Express GMT Field Buffer Overflow Vulnerability 2000-06-24: Microsoft Internet Explorer and Outlook/Outlook Express Remote File Write Vulnerability 2000-05-11: Microsoft Office 2000 UA Control Vulnerability 2000-02-19: Microsoft Signed ActiveX Active Setup Vulnerability 1999-11-08: Microsoft ActiveX CAB File Execution Vulnerability

6. © March 22, 2004 Novell Inc. 6 Autoexecution of code 1 st Demo Can code be executed without opening an e-mail message?

7. © March 22, 2004 Novell Inc. 7 Site Redirection 2 nd Demo Can a user be sent to a website that appears to be a legitimate and have improperly signed code run on the users machine that appears to be legitimate? Can this code run a program on the local workstation and send an e-mail to all users on the system?

8. © March 22, 2004 Novell Inc. 8 Hex Obfuscation/Hacking with Google 3 rd Demo Can critical information about users and companies be found using Google? Can an e-mail message be crafted to trick a user into executing code that looks legitimate?

9. © March 22, 2004 Novell Inc. 9 Attacks on AntiVirus Systems 4 th Demo Can executed code un-install Antivirus Software and infect a network

10. © March 22, 2004 Novell Inc. 10 Novacoast Security Assessments Who is Novacoast? What do we do?

11. © March 22, 2004 Novell Inc. 11 Credits and Sources Security Focus Astalavista.net DoxPara Research JohnnyIHackStuff Novacoast Security Group

13. © March 22, 2004 Novell Inc. 13 General Disclaimer This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners. No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.