TFS Gateway 4.0 - Denial of Service Vulnerability

1999-08-31T00:00:00
ID EDB-ID:19477
Type exploitdb
Reporter anonymous
Modified 1999-08-31T00:00:00

Description

TFS Gateway 4.0 Denial of Service Vulnerability. CVE-1999-1515. Dos exploit for hardware platform

                                        
                                            source: http://www.securityfocus.com/bid/613/info

TFS Gateway 4.0, when configured in a specific non-default manner, is vulnerable to a remotely exploitable denial of service attack. If 'return entire message to sender' is enabled for failed send attempts, and an email is sent to the TFS Gateway with 1: the From: address set to an invalid address on a remote machine and 2: an invalid To: address on the target machine, the gateway will attempt to return the complete message once every 10 seconds until an administrator manually stops it. If enough emails of sufficient size of this nature are sent it can lead to a degradation or denial of service.

telnet to Gateway smtp server and enter the following commands:

HELO
MAIL FROM: invalid@remote.com
RCPT TO: invalid@target.com
DATA

.
QUIT