NTMail VRFY Vulnerability
BID:856
Info
NTMail VRFY Vulnerability
| Bugtraq ID: | 856 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 29 1999 12:00AM |
| Updated: | Nov 29 1999 12:00AM |
| Credit: | Discovered and posted to Bugtraq on November 29, 1999 by George <[email protected]>. |
| Vulnerable: |
Gordano NTMail 4.3 Gordano NTMail 4.2 Gordano NTMail 4.0 |
| Not Vulnerable: |
Gordano NTMail 5.0 |
Discussion
NTMail VRFY Vulnerability
The VRFY command in ESMTP servers is an easy way for spammers to collect email adresses. Connecting to an ESMTP server and issuing a VRFY command with an email address will return a result of either 250 (address exists) or 557 (address does not exist). By sending multiple VRFY requests with arbitrary strings it is possible to generate a list of email addresses that are valid on the server, to be used for spam or as a basis for brute-force password attacks later.
NTMail has an option to disable the VRFY command, but it does not in fact do anything. even if set to 'disable' the server will still processs and respond to VRFY requests.
The VRFY command in ESMTP servers is an easy way for spammers to collect email adresses. Connecting to an ESMTP server and issuing a VRFY command with an email address will return a result of either 250 (address exists) or 557 (address does not exist). By sending multiple VRFY requests with arbitrary strings it is possible to generate a list of email addresses that are valid on the server, to be used for spam or as a basis for brute-force password attacks later.
NTMail has an option to disable the VRFY command, but it does not in fact do anything. even if set to 'disable' the server will still processs and respond to VRFY requests.
Exploit / POC
NTMail VRFY Vulnerability
see discussion
example:
telnet victimhost:25
220 mail.net-shopper.co.uk NTMail (v5.01.0003/AB0000.00.719cfeeb) ready for
ESMTP transfer
vrfy usera
250 usera@victimhost <usera@victimhost>.
vrfy userb
557 String does not match anything.
see discussion
example:
telnet victimhost:25
220 mail.net-shopper.co.uk NTMail (v5.01.0003/AB0000.00.719cfeeb) ready for
ESMTP transfer
vrfy usera
250 usera@victimhost <usera@victimhost>.
vrfy userb
557 String does not match anything.
Solution / Fix
NTMail VRFY Vulnerability
Solution:
In NTMail 5 VRFY can be turned off properly.
For NTMail 4.x:
There is another way to turn off VRFY besides the normal GUI interface. From a post to Bugtraq by NTMail Support:
To switch of the VRFY command, select "Support > System Variables" and choose the "AllowVRFY" variable from the drop-down. Set this to the value 0 and press "Change Value". You will now see the response: 558 VRFY not allowed.
Solution:
In NTMail 5 VRFY can be turned off properly.
For NTMail 4.x:
There is another way to turn off VRFY besides the normal GUI interface. From a post to Bugtraq by NTMail Support:
To switch of the VRFY command, select "Support > System Variables" and choose the "AllowVRFY" variable from the drop-down. Set this to the value 0 and press "Change Value". You will now see the response: 558 VRFY not allowed.