SkipNavigation
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric



 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips

 

Vulnerability Note VU#422156

Microsoft Exchange Server fails to properly handle specially crafted SMTP extended verb requests

Overview

Microsoft Exchange fails to handle certain SMTP extended verbs correctly. In Exchange 5.5, this can lead to a denial-of-service condition. In Exchange 2000, this could permit an attacker to run arbitrary code.

I. Description

Microsoft Exchange is a popular collaboration product which includes extensive support for electronic mail, including support for SMTP. SMTP is a standard protocol for exchanging electronic mail over the internet. Exchange uses SMTP to communicate special handling instructions from one Exchange server to another through the use of SMTP extended verbs. Exchange fails to process some of these commands correctly. On Exchange 5.5, the failure can result in a denial of service condition, and on Exchange 2000, it could result in an attacker running arbitrary code. For more information, see Microsoft Security Bulletin MS03-046.

II. Impact

An attacked could cause a denial of service condition against Exchange 5.5 or execute arbitrary code against Exchange 2000.

III. Solution

Apply a patch as described in Microsoft Security Bulletin MS03-046.

Systems Affected

VendorStatusDate Updated
Microsoft CorporationVulnerable15-Oct-2003

References


http://www.securityfocus.com/archive/1/341978
http://www.microsoft.com/technet/security/bulletin/MS03-046.asp
http://support.microsoft.com/default.aspx?scid=kb;en-us;829436

Credit

Thanks to Microsoft for reporting this vulnerability. Microsoft has credited Joćo Gouveia for reporting this vulnerability.

This document was written by Shawn Hernan based on information contained in Microsoft Security Bulletin MS03-046.

Other Information

Date Public10/15/2003
Date First Published10/15/2003 11:12:21 PM
Date Last Updated10/22/2003
CERT AdvisoryCA-2003-27
CVE NameCAN-2003-0714
US-CERT Technical Alerts 
Metric40.08
Document Revision5

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Copyright 2003 Carnegie Mellon University
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader