SMTP: Exchange Multiple Long Mail Route Commands

This signature detects attempts to exploit a known vulnerability in Microsoft Exchange Server. Unauthenticated attackers can remotely connect to the SMTP port on an Exchange server, then issue a crafted extended verb to run malicious programs in the security context of the SMTP service. This signature should be used between your Exchange servers and the Internet and not used between trusted Exchange servers to avoid potential false-positives.

Extended Description

Microsoft Exchange Server is prone to a buffer overflow in the X-LINK2STATE SMTP extended verb. Successful exploitation could result in arbitrary code execution.

Affected Products

Microsoft exchange_server_2003

References

BugTraq: 13118

CVE: CVE-2005-0560

URL: http://www.us-cert.gov/cas/techalerts/TA05-102A.html

Short Name

SMTP:EXCHANGE:MULTI-LONG-MAILRT

Severity

Critical

Recommended

False

Recommended Action

None

SMTP: Exchange Multiple Long Mail Route Commands

Extended Description

Affected Products

References

Found a potential security threat?