* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * University of Phoenix Outlook Express Unauthorized Configuration Manipulation Vendor Homepage: http://www.phoenix.edu Discovered by: Adam Baldwin (evilpacket@ngenuity-is.com) www.evilpacket.net\advisories\EP-000-0002.html Discovery Date: 1.17.2005 File Name: PhxStudent15.ocx Vulnerable Version: 2.00.0001 Overview: PhxStudent15.ocx is an activex control used to setup e-mail / NNTP and LDAP accounts in Outlook Express. This control remains on the users system long after the setup process has completed. This activex control can be used to manipulate the users account settings (imap / smtp / nntp / ldap). The following is an example of how to embed this control into a website with the proper param's. Note the account is only 'modified' if the "Program" param remains the same, which is not difficult. Any of the other settings can be modified to cause any number of attacks from denial of service to theft of login credentials, (be inventive :-) Example:

Mitigation: The University of Phoenix has been contacted but no response has been received. I would recommend that students remove this activex control and only allow it to be installed while registering for classes. Notes: At this time further exploitation does not appear possible, although on the following platform (with modification of the params) would crash IE after the ocx was loaded and crashed 3 times in the same browser window, which begs further research. Platform: Windows XP SP2, IE 6.0.2900.2180.xpsp2_rtm.040803-2158 * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html