search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Microsoft Windows 2000 SMTP service fails to properly authenticate credentials of unauthorized user (MS01-037)

Vulnerability Note VU#435963

Original Release Date: 2001-08-18 | Last Revised: 2001-08-18

Overview

A vulnerability exists in the SMTP service installed by default on Microsoft Windows 2000 Server (and optionally on Windows 2000 professional) that could allow an intruder to use the service to send mail.

Description

The Simple Mail Transfer Protocol (SMTP) is the standard protocol used to transport mail across the Internet. Microsoft Windows 2000 Server contains an SMTP server that requires authentication before users are permitted to send mail. A flaw in the way the server handles authentication could permit an intruder to use the service to send mail without providing genuine credentials.

For more information, see Microsoft security bulletin MS01-037.

It should be noted that even in the best of circumstances, SMTP is a very difficult to authenticate without end-to-end cryptographic solutions. Quoting from RFC 2821:

    SMTP mail is inherently insecure in that it is feasible for even fairly casual users to negotiate directly with receiving and relaying SMTP servers and create messages that will trick a naive recipient into believing that they came from somewhere else. Constructing such a message so that the "spoofed" behavior cannot be detected by an expert is somewhat more difficult, but not sufficiently so as to be a deterrent to someone who is determined and knowledgeable. Consequently, as knowledge of Internet mail increases, so does the knowledge that SMTP mail inherently cannot be authenticated, or integrity checks provided, at the transport level. Real mail security lies only in end-to-end methods involving the message bodies, such as those which use digital signatures...

Impact

Intruders may be able to send mail through a vulnerable server in violation of local security policies.

Solution

The CERT/CC is currently unaware of a general purpose solution to this problem without strong digital signatures on all mail messages. To address the specific problem in the Microsoft SMTP server, apply a patch as described in MS01-037.

Vendor Information

435963
Expand all

Microsoft

Updated:  August 17, 2001

Status

  Vulnerable

Vendor Statement

See http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms01-037.asp

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This document was written by Shawn V. Hernan.

Other Information

CVE IDs: CVE-2001-0504
Severity Metric: 5.70
Date Public: 2001-07-05
Date First Published: 2001-08-18
Date Last Updated: 2001-08-18 03:00 UTC
Document Revision: 4

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.