Microsoft Windows 2000 and Exchange 5.5 SMTP service unauthorized mail privileges
| ms-smtp-unauth-priv (8304) |  Medium Risk |
Description:
Microsoft Windows and Microsoft Exchange Server could allow a remote attacker to gain unauthorized mail privileges, caused by an authentication vulnerability in the Simple Mail Transfer Protocol (SMTP) service. In Exchange Server, the SMTP service is implemented as part of the Internet Mail Connector (IMC) feature. If a remote attacker can successfully authenticate to the server, mail privileges can be obtained without requiring any further authentication by the SMTP service. This could allow the attacker to send mail as a legitimate user and perform mail relaying.
Consequences:
Gain Privileges
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS02-011. See References.
References:
- BindView RAZOR Security Advisory, March 1, 2002: IIS SMTP component allows mail relaying via Null Session.
- Microsoft Security Bulletin MS02-011: Authentication Flaw Could Allow Unauthorized Users To Authenticate To SMTP Service.
- BID-4205: Microsoft Windows SMTP Service Authorization Bypass Vulnerability
- CVE-2002-0054: SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.
- US-CERT VU#874115: Microsoft Windows SMTP Service fails to properly handle responses from the NTLM authentication layer
Platforms Affected:
- Microsoft Exchange Server 5.5
- Microsoft Windows 2000
Reported:
Feb 27, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net