Used Microsoft Windows 2000 Authentication Flaw Could Allow Unauthorized Users To Authenticate To SMTP Service for Windows? Share your experience and help other users.
Developer’s Description
By design, the Windows 2000 SMTP service and the Exchange Server 5.5 IMC, upon receiving notification from the NTLM authentication layer that a user has been authenticated, should perform additional checks before granting the user access to the service. The vulnerability results because the affected services don't perform this additional checking correctly. In some cases, this could result in the SMTP service granting access to a user solely on the basis of their ability to successfully authenticate to the server.
An attacker who exploited the vulnerability could gain only user-level privileges on the SMTP service, thereby enabling the attacker to use the service but not to administer it. The most likely purpose in exploiting the vulnerability would be to perform mail relaying via the server.
Used Microsoft Windows 2000 Authentication Flaw Could Allow Unauthorized Users To Authenticate To SMTP Service for Windows? Share your experience and help other users.
