RE: MS Exchange 'Recall' feature - Possible to delete mail?

["Damiano, Anthony" <Anthony.Damiano () unistudios com>]

Exchange doesn't exactly allow you to delete the message. What it does is sends an additional "Recall Request" to the 
recipient and if that message is read, depending on whatever action the sender chooses, Outlook will either delete the 
message or replace the message with a different version. However, recall can fail if the recipient chooses not to 
acknowledge the recall request by deleting it before its read. That's a misconception as it doesn't actually allow the 
sender access to the recipients mailbox.

-----Original Message-----
From: Viraj Alankar [mailto:valankar () access4less net] 
Sent: Sunday, August 24, 2003 6:56 PM
To: vuln-dev () securityfocus org
Subject: MS Exchange 'Recall' feature - Possible to delete mail?


Hello,

I don't run Exchange but recently came across it's 'recall message' functionality. To me, it just seems dangerous to 
allow a sender to delete a message from a recipient's mailbox. I understand this will only work for Exchange systems, 
but is it possible for a malicious user outside the network/domain to send fake 'recall' messages and delete users' 
mail? Also, even within an Exchange network, would it be possible for a malicious employee to delete another employee's 
mail that they did not send?

All I can tell from these 'recall' messages are that there is the header:

X-MAPI-Message-Class: IPM.Outlook.Recall
Subject: Recall: subject

And a winmail.dat TNEF attachment.

Anyone know much more about this?

Viraj.