NTMail does not disable the VRFY command
| nt-mail-vrfy (3719) |  Low Risk |
Description:
The NTMail VRFY command could allow account information to be used for address spamming. When VRFY is enabled, the mail server provides information about active accounts and domain names. This makes it easy to write a single script that can be used against ALL NTMail 4 or 5 servers to gain email addresses for commercial or advertising use.
Consequences:
Obtain Information
Remedy:
Disable the VRFY command.
To disable the VRFY command:
- Open the NTMail user interface.
- Select Support, System Variables, and choose the AllowVRFY option.
- Set the value to 0 and click Change Value. You will see the response: 558 VRFY not allowed.
References:
- BugTraq Mailing List, Tue Nov 30 1999 - 05:25:31 CST: NTmail and VRFY.
- NTBugTraq Mailing List, Tue 30 Nov 1999 20:41:33 -0500: NTmail and VRFY.
- Request for Comment document RFC 2505: Anti-Spam Recommendations for SMTP MTAs.
- BID-856: NTMail VRFY Vulnerability
- CVE-1999-0819: NTMail does not disable the VRFY command, even if the administrator has explicitly disabled it.
Platforms Affected:
- Gordano NTMail 4.0
- Gordano NTMail 4.2
- Gordano NTMail 4.3
Reported:
Nov 29, 1999
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net