SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Microsoft Exchange Vendors:   Microsoft
Microsoft Exchange Heap Overlow in Processing Extended SMTP Verb Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1013687
SecurityTracker URL:  http://securitytracker.com/id/1013687
CVE Reference:   CVE-2005-0560   (Links to External Site)
Date:  Apr 12 2005
Impact:   Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2000 SP3, 2003, 2003 SP1
Description:   A buffer overflow vulnerability was reported in Microsoft Exchange. A remote user can execute arbitrary code on the target system.

A remote user can connect to the Exchange SMTP service and supply a specially crafted extended SMTP verb to trigger a heap overflow. Arbitrary code will be executed with System privileges.

On Exchange 2003, authentication is required by default before the specific extended SMTP verb can be supplied. On Exchange 2000, no authentication is required.

The vendor credits Mark Dowd and Ben Layer of ISS X-Force with reporting this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system with System level privileges.
Solution:   The vendor has issued the following fixes:

Microsoft Exchange 2000 Server Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?FamilyId=2A2AF17E-2E4A-4479-8AC9-B5544EA0BD66

Microsoft Exchange Server 2003:

http://www.microsoft.com/downloads/details.aspx?FamilyId=97F409EB-C8D0-4C94-A67B-5945E26C9267

Microsoft Exchange Server 2003 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?FamilyId=35BCE74A-E84A-4035-BF18-196368F032CC

A restart is not required if all applications are closed prior to installation. The security update will restart the IIS, SMTP, and the Exchange Server Information Store Service. The File Transfer Protocol (FTP) and Network News Transfer Protocol (NNTP) services will also be affected.

Vendor URL:  www.microsoft.com/technet/security/Bulletin/MS05-021.mspx (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (2000), Windows (2003), Windows (XP)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC