Scott, I'm doing a very extensive review of network security using an external source to scan our network and identify weak points. One of the weak points is that they are finding that the Imail server has the following vulnerabilities
Issue 1 smtp (25/tcp) The remote SMTP server answers to the EXPN and/or VRFY commands. The EXPN command can be used to find the delivery address of mail aliases, or even the full name of the recipients, and the VRFY command may be used to check the validity of an account. Your mailer should not allow remote users to use any of these commands, because it gives them too much information. Issue 2 IPSwitch IMail SMTP Buffer Overflow Description smtp (25/tcp) A vulnerability exists within IMail that allows remote attackers to gain SYSTEM level access to servers running IMail's SMTP daemon (versions 6.06 and below). The vulnerability stems from the IMail SMTP daemon not doing proper bounds checking on various input data that gets passed to the IMail Mailing List handler code. If an attacker crafts a special buffer and sends it to a remote IMail SMTP server it is possible that an attacker can remotely execute code (commands) on the IMail system. Issue 3 smtpscan Description smtp (25/tcp) This server could be fingerprinted as being IMail 7.15 -14- smtpscan is a SMTP fingerprinting tool written by Julien Bordet It identifies the remote mail server even if the banners were changed. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry Sent: Wednesday, September 17, 2003 11:02 AM To: [EMAIL PROTECTED] Subject: Re: [IMail Forum] Disable EXPN and VRFY Commands >How do I disable the EXPN and VRFY Commands? There is a "Disable SMTP VRFY" option in the IMail Administrator under SMTP settings. EXPN is not used by IMail, AFAIK. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers. Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection. Find out what you've been missing: Ask about our free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ ---------------------------------------------------------------------------- -- [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] ------------------------------------------------------------------------------ [This E-mail was scanned for viruses by Declude Virus Scanner on mail.nfti.com] To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
