[SECURITY] New versions of smtp-refuser fixes security hole

This bug was experienced in May 1999 but wasnt reported on this channel yet. Former versions of the smtp-refuser package came with unchecked logging facility to /tmp/log. This allowed deleting arbitrary, root-owned files by any user who has write access to /tmp. We recommend you upgrade your...

PT-1999-1310 · Debian · Smtp-Refuser

Name of the Vulnerable Software and Affected Versions: Debian smtp-refuser affected versions not specified Description: The issue affects the logging facility of the Debian smtp-refuser package, allowing local users to delete arbitrary files using symbolic links. Recommendations: At the moment,...

Multiple MTA HELO Command Remote Overflow

The remote SMTP server seems to allow remote users to send mail anonymously by providing arguments that are too long to the HELO command more than 1024 chars. This problem may allow malicious users to send unsolicited mail i.e., SPAM or threatening mail using the server, and keep their anonymity....

smtp.acct.probing.txt

http://www.l8r.com/nwa/nwa1.htm Network Abuse Information SMTP Server abuse Software: GeoList Pro Author: www.earthonline.com SPECIAL UPDATE: 03/08/99 GeoList Pro is being pulled from distribution. Details can be found at EarthOnline's Site. Use the URL above. Jump to Updates Original Posting:...

ms.smtp.DoS.txt

Date: Sun, 14 Mar 1999 20:49:30 -0600 From: Chris Adams To: [email protected] Subject: Microsoft's SMTP service broken/stupid Our mail servers came to a screeching halt today thanks to Microsoft. Our servers are still running sendmail 8.8 we've got custom stuff and are working on upgrading to...

lotus-notes-smtp-DoS.txt

Date: Fri, 15 Jan 1999 00:52:53 PST From: Siva Sankar Adiraju To: [email protected] Subject: Lotus Notes SMTP Server bug There is a security bug in IBM's Lotus Notes SMTP server. eg. An SMTP session: helo a 250 notes.foo.com helo b 500 Session already established. The domain name b passed in...

lotus.notes.relay.txt

Date: Mon, 14 Jun 1999 17:40:35 +0100 From: Robert Lister To: [email protected] Subject: Lotus Notes Relay Following postings about NTMail having open relaying ability, in certain situations I have identified a problem with the Lotus SMTP MTA right up to v4.6.4, have yet to test...

ibm.as400.smtp.DoS.txt

Date: Tue, 4 May 1999 08:53:14 +0200 From: Joachim Larsson To: [email protected] Subject: AS/400 Hello all. I played around with smtp on a as/400+domino machine and found two obvious bugs, then notified IBM, revieved a ptf, then posted here. 1: telnet host 25, then start feeding chars. After...

iis4.0.smtp.DoS.txt

Date: Tue, 16 Feb 1999 14:03:43 -0600 From: Bug Traqqer To: [email protected] Subject: Re: IIS 4.0 SMTPSVC vs. QMAIL To all- if you find this problem happening to you there are fixes on both product sides. Qmail has provided a patch for stray line feeds. It is available through the...

qmail-DoS-anonymous.txt

Date: Tue, 5 Jan 1999 22:41:44 -0000 From: D. J. Bernstein To: [email protected] Subject: Re: Anonymous Qmail Denial of Service News flash: There are dozens of denial-of-service attacks on every MTA. Example: Any Internet user can create a continuing torrent of mail from random Internet...

promail.1.21.trojan.txt

Date: Fri, 19 Mar 1999 09:41:18 +0100 From: Aeon Labs To: [email protected] Subject: security/privacy news Perhaps this might be of interest to Your readers. ProMail v1.21, an advanced freeware mail program spread through several worldwide distribution networks SimTel.net, Shareware.co...

CVE-1999-0682

Microsoft Exchange 5.5 allows a remote attacker to relay email i.e. spam using encapsulated SMTP addresses, even if the anti-relaying features are enabled...

MDaemon SMTP HELO Command Remote Overflow DoS

It was possible to crash the remote SMTP server by sending a too long argument to the HELO command. This allows an unauthenticated, remote attacker to deny service to legitimate users of the server. It may also indicate the service is affected by a buffer overflow vulnerability which, if true,...

MTA Open Mail Relaying Allowed

Nessus has detected that the remote SMTP server allows mail relaying. This issue allows any spammer to use your mail server to send their mail to the world, thus flooding your network bandwidth and possibly getting your mail server blacklisted. C Tenable Network Security, Inc. include'compat.inc'...

SLMail HELO Command Remote Overflow

There might be a buffer overflow when this MTA is issued the 'HELO' command issued by a too long argument. This problem may allow an attacker to execute arbitrary code on this computer, subject to the privileges under which the service operates, or to deny service to legitimate users of the serve...

Ipswitch IMail / SLMail VRFY Command Remote Overflow

It was possible to crash the affected SMTP service by sending a VRFY command with a long argument. This attack is known to affect certain versions of Ipswitch IMail and Seattle Labs' SLMail, although products from other vendors may also be affected. An unauthenticated, remote attacker can leverag...

NTMail3 Arbitrary Mail Relay

Nessus has detected that the remote SMTP server allows anyone to use it as a mail relay provided that the source address is set to ''. This issue allows any spammer to use your mail server to send their mail to the world, thus flooding your network bandwidth and possibly getting your mail server...

Lotus Notes SMTP Server HELO Command Overflow DoS

It was possible to perform a denial of service against the remote SMTP server by sending it two HELO commands followed by a too long argument. This allows an unauthenticated, remote attacker to deny service to legitimate users of the server. C Tenable Network Security, Inc. include"compat.inc";...

NetManage Chameleon SMTPd Remote Overflow DoS

The remote host appears to be running NetManage Chameleon SMTPd. This version of the software has a remote buffer overflow vulnerability. Nessus crashed the service by issuing a long argument to the HELP command. A remote attacker could exploit this issue to crash the service, or possibly execute...

Lotus Domino 4.6.14.6.4 Notes - SMTPA MTA Mail Relay

Lotus Domino 4.6.14.6.4 Notes - SMTPA MTA Mail Relay source: https://www.securityfocus.com/bid/487/info Lotus Notes SMTP MTA is susceptible to being used as a mail relay for SPAM or other unsolicited email. Connecting to the mail server tcp25 and issuing a 'mail from' command with as the data may...