SecurityWeek reports that Microsoft Office 365 Message Encryption is being impacted by a vulnerability within the Electronic Codebook it uses that could result in the exposure of certain structural data related to emails.
"Attackers who are able to get their hands on multiple messages can use the leaked ECB info to figure out the encrypted contents. More emails make this process easier and more accurate," said WithSecure researcher Harry Sintonen, who identified and reported the flaw to Microsoft, which rewarded him $5K for the discovery.
Despite providing an award for the bug discovery, Microsoft has deemed the flaw not sufficient enough to be considered for security servicing.
"Any organization with personnel that used OME to encrypt emails are basically stuck with this problem. For some, such as those that have confidentiality requirements put into contracts or local regulations, this could create some issues. And then of course, theres questions about the impact this data could have in the event its actually stolen, which makes it a significant concern for organizations," said Sintonen, who urged against OME usage for sensitive file encryption.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.