Microsoft Exchange Server SMTP HELO Argument Buffer Overflow Vulnerability

Bugtraq ID:	8555
Class:	Boundary Condition Error
CVE:	CVE-1999-0284
Remote:	Yes
Local:	No
Published:	Mar 10 1998 12:00AM
Updated:	Mar 19 2015 08:10AM
Credit:	Discovery of this vulnerability has been credited to rootshell.com.
Vulnerable:	Microsoft Exchange Server 5.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Ipswitch IMail 5.0 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Alt-N MDaemon 2.71 SP1
Not Vulnerable:	Microsoft Exchange Server 5.0 SP2 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0

Microsoft Exchange Server SMTP HELO Argument Buffer Overflow Vulnerability

It has been reported that Microsoft Exchange server is prone to an SMTP HELO command argument buffer overflow vulnerability.

The issue presents itself likely due to insufficient bounds checking performed when handling malicious SMTP HELO command arguments of excessive length. It has been reported that a remote attacker may exploit this condition to trigger a denial of service in the affected daemon.

Microsoft Exchange Server SMTP HELO Argument Buffer Overflow Vulnerability

The following proof of concept has been supplied:

• /data/vulnerabilities/exploits/heloexpl.c

Microsoft Exchange Server SMTP HELO Argument Buffer Overflow Vulnerability

Solution:
This issue is reported to be fixed in Microsoft Exchange 5.0 service pack 2.


Microsoft Exchange Server 5.0 SP1

• Microsoft Exchange Server 5.0 U.S. Service Pack 2
  ftp://ftp.microsoft.com/bussys/exchange/exchange-public/fixes/eng/exch g5.0/Sp2/

Microsoft Exchange Server SMTP HELO Argument Buffer Overflow Vulnerability

References: