NTMail does not disable the VRFY command

nt-mail-vrfy (3719)

Low Risk

Description:

The NTMail VRFY command could allow account information to be used for address spamming. When VRFY is enabled, the mail server provides information about active accounts and domain names. This makes it easy to write a single script that can be used against ALL NTMail 4 or 5 servers to gain email addresses for commercial or advertising use.

Platforms Affected:

• Gordano, NTMail 4.0
• Gordano, NTMail 4.2
• Gordano, NTMail 4.3

Remedy:

Disable the VRFY command.

To disable the VRFY command:

1. Open the NTMail user interface.
2. Select Support, System Variables, and choose the AllowVRFY option.
3. Set the value to 0 and click Change Value. You will see the response: 558 VRFY not allowed.

Consequences:

Obtain Information

References:

• BugTraq Mailing List, Tue Nov 30 1999 - 05:25:31 CST, NTmail and VRFY at http://archives.neohapsis.com/archives/bugtraq/1999-q4/0143.html.
• NTBugTraq Mailing List, Tue 30 Nov 1999 20:41:33 -0500, NTmail and VRFY at http://ntbugtraq.ntadvice.com/default.asp?pid=36&sid=1&A2=ind9912&L=NTBUGTRAQ&P=R587&D=0&H=0&O=T&T=1.
• Request for Comment document RFC 2505, Anti-Spam Recommendations for SMTP MTAs at http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc2505.html.
• BID-856: NTMail VRFY Vulnerability
• CVE-1999-0819: NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it.

Reported:

Nov 29, 1999

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page