vendor:
Exchange Server 5.5, IIS 4.0 and 5.0
by:
SecurityFocus
7,5
CVSS
HIGH
Encapsulated SMTP Address Vulnerability
601
CWE
Product Name: Exchange Server 5.5, IIS 4.0 and 5.0
Affected Version From: Microsoft Exchange 5.5, IIS 4.0 and 5.0
Affected Version To: Microsoft Exchange 5.5, IIS 4.0 and 5.0
Patch Exists: Yes
Related CWE: CVE-1999-0752
CPE: a:microsoft:exchange_server:5.5, cpe:/a:microsoft:iis:4.0, cpe:/a:microsoft:iis:5.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2002
Microsoft Exchange 5.5 and IIS SMTP Service Encapsulated SMTP Address Vulnerability
Microsoft Exchange 5.5 and the SMTP (Simple Mail Transfer Protocol) service included with IIS (Internet Information Services) 4.0 and 5.0 are vulnerable to an encapsulated SMTP address vulnerability. The vulnerability allows an attacker to bypass the SMTP server's security checks and send emails to arbitrary recipients, even if the SMTP server is configured to only allow relaying for certain domains. This can be exploited by sending an email with an encapsulated address, such as IMCEASMTP-test+40test+2Ecom@victim.co.uk, which will be accepted by the SMTP server.
Mitigation:
Microsoft has released a patch to fix the vulnerability for Exchange Server 5.5. For IIS SMTP service, it is recommended to disable relaying or restrict it to certain domains.
