Video Screencast Help

Link in Spam Quarantine Summary security issue

Created: 12 Jul 2010 | 2 comments
LEOL's picture
1 Agree
1 Disagree
0 2 Votes
Login to vote

We are having security concern for enabling the View and Release link in the spam quarantine summary digest.

Example
Say the mailbox owner is Mr A. Ms B is the secretary of Mr A
If Mr A forward the digest received with “Release”/”View” link embedded to Ms B, Ms B can fully manage the spam folder of Mr A without any further authentication. ( fully manage here means view and release quarantined email in Mr A's the spam folder )
When Ms B changed the job duty, there is no way to stop Ms B seeing Mr A's quarantined area.
Mr A constantly receive legitimate email in the quarantine area and if it is considered confidential, this create a security concern.

Alternative
Disable view or release link

Drawback
If the view or release link is disabled, spam in Public Folders or Shared Mailboxes cannot be released by their users

Suggestion
Do not show the "Quarantine" link on the left, "Previous", "Next" and the "Back to Messages" button on the web interface when user is accessing through the link in the digest.

This is to limit any user with the hold of the digest to be only able to view or release the email of the specific link in the digest.

Comments 2 CommentsJump to latest comment

Cricket17's picture

Do you have user authentication enabled?

Symantec: if LEOL does, then SBG should be requiring authentication that the Digest URL is being accessed by the reciepent of the digest.  The digest should encode the recipient in the links and require authentication on accessing the quaratine.  Other competitive products do this.

0
Login to vote
LEOL's picture

"Control Center authentication only" is enabled already under Administration->Directory Integration->Authentication. Indeed, if the user click on the link /brightmail">https://<server>/brightmail, the login screen do show up. However, if user click on the "view" or "release" link, no authentication is needed. Am I missing something here?

Also, how about public folders where there is no username/password? And the shared mailbox where the account is disabled in Windows/Exchange environment?

0
Login to vote