| VID |
18011 |
| Severity |
30 |
| Port |
25 |
| Protocol |
TCP |
| Class |
SMTP |
| Detailed Description |
The Microsoft SMTP server is vulnerable to an encapsulated SMTP address vulnerability.
Microsoft Exchange 5.5 and the SMTP (Simple Mail Transfer Protocol) service included with IIS (Internet Information Services) 4.0 and 5.0 are vulnerable to an encapsulated SMTP address vulnerability even with anti-relaying features enabled. This vulnerability allows hosts that are not authorized to relay e-mail via the SMTP server to bypass the anti-relay features and send mail to foreign domains.
The vulnerability was originally announced in Microsoft Security Bulletin MS99-027 and reported to affect Exchange Server 5.5. Microsoft released a patch to fix the vulnerability for Exchange Server 5.5 only. It has been recently reported that this vulnerability also affects the SMTP service included with Microsoft IIS 4.0 and 5.0.
Platforms Affected:
Microsoft Exchange Server 5.5 SP2
Microsoft Exchange Server 5.5 SP1
Microsoft Exchange Server 5.5
Microsoft IIS 4.0
Microsoft IIS 5.0 |
| Recommendation |
Microsoft announced and released patches for this vulnerability in 1999. At that time it was not reported that the SMTP service for IIS is also affected. Patches were not issued and are not available as of July 2002. As a workaround, disable the SMTP service until the patches are provided.
The patches (released in 1999) for Exchange Server are listed below. Note that the appropriate service pack must be installed prior to installing these patches:
Microsoft Exchange Server 5.5 SP2:
Microsoft Patch psp2imca.zip
ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/Eng/Exchg5.5/PostSP2/imc-fix/psp2imca.zip
Microsoft Patch psp2imci.zip
ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/Eng/Exchg5.5/PostSP2/imc-fix/psp2imci.zip |
| Related URL |
CVE-2002-1790 (CVE) |
| Related URL |
5213 (SecurityFocus) |
| Related URL |
9580 (ISS) |
|
