Exchange Server Forums

Send As and OWA Bug

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Server Security >> Send As and OWA Bug

Page: [1]

Message

<< Older Topic Newer Topic >>

Limited time MSExchange.org offer! -- 1.Sep.2008 1:00:00 PM

TechGenix and SolarWinds have partnered to provide free copies of SolarWinds Exchange Monitor to all visitors who join the MSExchange.org Forums. SolarWinds Exchange Monitor is a handy desktop dashboard that continuously monitors Microsoft Exchange to deliver real-time insight into Exchange services, mail queue sizes, and host server health. Learn more about Exchange Monitor and the free offer!

Send As and OWA Bug - 20.Oct.2006 8:29:52 AM

s.loquet

Posts: 2
Joined: 20.Oct.2006
Status: offline

Hello, i use Exchange 2003 SP2
Patchs :
912442 Security Update
916803 Security Update
911829 HotFix
895949 IE patch

I have to give rights but there's a bug

I create 2 new fresh new users : user1 and user2

I give to user1 "FullMailBox access" to user2 and nothing else.

I connect to Outlook with the client using user1
I have added user2 mailbox

If I send an email an I change the "From :" field there's nothing wrong
The email is received => user2 on behalf user1
So that's ok

Now, if i do the same but using OWA
http://exchange/echange
first I connect, and then I had /user2
I send the email... and it is received has coming from user2 (no mention of user1)
So Fake Identity

You can look at KB912918 and how to solve it... it doesn"t work because I can send and email without having the "send as" ... within OWA.

Security hole???

I Still have no anwser

Post #: 1

Featured Links*

RE: Send As and OWA Bug - 20.Oct.2006 5:33:20 PM

joshh385

Posts: 141
Joined: 2.May2006
Status: offline

This is expected behavior. OWA doesn't provide a send on behalf of feature natively. Because you've given the second user full access to the mailbox they are allowed to logon to the mailbox of the other user via OWA. When you open the first mailbox as an additional mailbox in Outlook, it is smart enough to know that you are sending on behalf of the user. If all you're looking for is send on behalf of permissions I would suggest granting them via the Exchange General tab on the user account in AD vs. granting full mailbox access.

(in reply to s.loquet)

Post #: 2

RE: Send As and OWA Bug - 22.Oct.2006 2:12:45 PM

jchong

Posts: 2516
Joined: 1.Dec.2005
From: Centreville, Virginia
Status: offline

Send as through OWA is not available, you would need a third party tool.

http://www.ivasoft.biz/choosefromowa.shtml

_____________________________

James Chong
MCSE | M+, S+, MCTS, Security+
msexchangetips.blogspot.com

(in reply to joshh385)

Post #: 3