SMTP verify (VRFY) command can be used to validate users
| smtp-vrfy (130) |  Medium Risk |
Description:
The SMTP VRFY command is enabled. The VRFY (Verify) command allows an attacker to determine if an account exists on a system, providing significant assistance to a brute force attack on user accounts. VRFY provides additional information about users on the system, such as if they exist and their full names. This information can be useful in further attacks.
Platforms Affected:
- Compaq, Tru64
- Data General, DG/UX
- HP, HP-UX 10.20
- HP, HP-UX 11
- HP, HP-UX
- IBM, AIX 4
- IBM, AIX
- Linux, Kernel
- RedHat, Linux 6.0
- RedHat, Linux 7
- RedHat, Linux 7.1
- RedHat, Linux 7.2
- RedHat, Linux 7.3
- SCO, SCO Unix
- SGI, IRIX
- Sun, Solaris 2.5.1
- Sun, Solaris 2.6
- Sun, Solaris 7.0
- Sun, Solaris 8
- Sun, Solaris
- Various vendors, SMTP servers
- WindRiver, BSDOS
Remedy:
If you are running Sendmail, add the line Opnovrfy to your Sendmail configuration file, usually located in /etc/sendmail.cf. For other mail servers, contact your vendor for information on how to disable the verify command.
Upgrade to the latest version of Sendmail (8.11.3 or later), available from the Sendmail Consortium Web site. See References.
Consequences:
Obtain Information
References:
- Sendmail Consortium FTP site, Latest software version at ftp://ftp.cs.berkeley.edu/ucb/sendmail.
- Sendmail Consortium Web site, Sendmail FAQ at http://www.sendmail.org/faq/.
- Sendmail Consortium Web site, Latest software version at http://www.sendmail.org/.
- CVE-1999-0531: An SMTP service supports EXPN, VRFY, HELP, ESMTP, and/or EHLO.
Reported:
Not available
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net