Microsoft Windows 2000 Authentication Flaw Could Allow Unauthorized Users To Authenticate To SMTP Service logo

Microsoft Windows 2000 Authentication Flaw Could Allow Unauthorized Users To Authenticate To SMTP Service

By Microsoft Free

Download.com has removed the direct-download link and offers this page for informational purposes only.

Download.com has chosen not to provide a direct-download link for this product and offers this page for informational purposes only.

Developer's Description

An SMTP service installs by default as part of Windows 2000 server products and as part of the Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5. (The IMC, also known as the Microsoft Exchange Internet Mail Service, provides access and message exchange to and from any system that uses SMTP). A vulnerability results in both services because of a flaw in the way they handle a valid response from the NTLM authentication layer of the underlying operating system.

By design, the Windows 2000 SMTP service and the Exchange Server 5.5 IMC, upon receiving notification from the NTLM authentication layer that a user has been authenticated, should perform additional checks before granting the user access to the service. The vulnerability results because the affected services don't perform this additional checking correctly. In some cases, this could result in the SMTP service granting access to a user solely on the basis of their ability to successfully authenticate to the server.

An attacker who exploited the vulnerability could gain only user-level privileges on the SMTP service, thereby enabling the attacker to use the service but not to administer it. The most likely purpose in exploiting the vulnerability would be to perform mail relaying via the server.

Full Specifications

What's new in version Q313450

General

Release August 25, 2008
Date Added February 28, 2002
Version Q313450

Operating Systems

Operating Systems Windows, Windows 2000
Additional Requirements
  • Windows 2000
  • Popularity

    Total Downloads 24
    Downloads Last Week 0
    Report Software

    Related Software

    Driver Booster logo

    Driver Booster

    Free
    Driver Booster
    Windows 10 logo

    Windows 10

    $139.00
    Windows 10

    Apple Windows Migration Assistant

    Free
    Apple Windows Migration Assistant
    Andy OS logo

    Andy OS

    Free
    Andy OS
    Promo image for CNET Shopping

    Get the best price on everything

    Shop your favorite products and we’ll find the best deal with a single click. Designed to make shopping easier.