Possible Exchange 5.5 Server DoS

2000-09-14T00:00:00
ID SECURITYVULNS:DOC:682
Type securityvulns
Reporter Securityvulns
Modified 2000-09-14T00:00:00

Description

<<exerror.zip>> This happend early this morning on one of our mailservers running Exchange 5.5 on WinNT4 OP5. Suddenly the Information Store (STORE.EXE) crashed with a strange error saying something in the way of "Error while processing an email message", restarting both the server and all of Exchange's components has no effect at all. The only way of solving this problem as I discovered is to shut down all Exchange Services and Totally remove the content of the IMCDATA directory containing the mail queues and then restart exchange.

It seems that the attachment line is the problem, by removing the attachment and sending the mail nothing happens.

Anyone know of some more information about this "DoS" attack or how it can be prevented, I have not seen any off things in the mail that would bring an Exchange server to a stop.

This message has been sent to Microsoft who has not yet given any answer.

Regards,


christer.enberg@deo.com system administrator / computer technician

wallingatan 11, 111 60 Stockholm tel +46 8 412 41 19, fax +46 8 412 41 79 mob +46 733 73 33 19 www.deo.com