SMTP verify (VRFY) command can be used to validate users
| smtp-vrfy (130) |  Medium Risk |
Description:
The SMTP VRFY command is enabled. The VRFY (Verify) command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY provides additional information about users on the system, such as if they exist and their full names. This information can be useful in further attacks.
Consequences:
Obtain Information
Remedy:
If you are running Sendmail, add the line Opnovrfy to your Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact your vendor for information on how to disable the verify command.
Upgrade to the latest version of Sendmail (8.11.3 or later), available from the Sendmail Consortium Web site. See References.
References:
- Sendmail Consortium FTP site: Latest software version.
- Sendmail Consortium Web site: Sendmail FAQ.
- Sendmail Consortium Web site: Latest software version.
- CVE-1999-0531: An SMTP service supports EXPN, VRFY, HELP, ESMTP, and/or EHLO.
Platforms Affected:
- Compaq Tru64
- Data General DG/UX
- HP HP-UX 10.20
- HP HP-UX 11
- IBM AIX 4
- IBM AIX
- IETF SMTP
- Linux Kernel
- RedHat Linux 6.0
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.2
- RedHat Linux 7.3
- SCO SCO Unix
- SGI IRIX
- Sun Solaris 2.5.1
- Sun Solaris 2.6
- Sun Solaris 7.0
- Sun Solaris 8
- Sun Solaris
- WindRiver BSDOS
- HP-UX
Reported:
Not available
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net