Microsoft Security Bulletin MS03-046

Technical Description:

Subsequent to the release of this bulletin, it was determined that the vulnerability addressed also affects Exchange Server 5.0. Microsoft has updated the bulletin with additional information about Exchange Server 5.0 and also to direct users to a security update for this additional affected platform. This security update for Exchange 5.0 is a cumulative rollup package that also addresses the vulnerabilities discussed in MS00-082 and MS01-041. You need only install this security update once to be protected against all three vulnerabilities.

In Exchange Server 5.0 and Exchange Server 5.5, a security vulnerability exists in the Internet Mail Service that could allow an unauthenticated attacker to connect to the SMTP port on an Exchange server and issue a specially-crafted extended verb request that could allocate a large amount of memory. This could shut down the Internet Mail Service or could cause the server to stop responding because of a low memory condition.

In Exchange 2000 Server, a security vulnerability exists that could allow an unauthenticated attacker to connect to the SMTP port on an Exchange server and issue a specially-crafted extended verb request. That request could cause a denial of service that is similar to the one that could occur on Exchange Server 5.0 and Exchange Server 5.5. Additionally, if an attacker issues the request with carefully chosen data, the attacker could cause a buffer overrun that could allow the attacker to run malicious programs of their choice in the security context of the SMTP service.

Mitigating Factors: 

Severity Rating:

The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them.

Vulnerability Identifier: CAN-2003-0714

Microsoft has tested the following workarounds. These workarounds will not correct the underlying vulnerability however they help block known attack vectors. Workarounds may cause a reduction in functionality in some cases - in such situations this is identified below.

Why is Microsoft reissuing this bulletin?
Subsequent to the release of this bulletin, it was determined that the vulnerability addressed also affects Exchange Server 5.0. Microsoft has updated the bulletin with additional information about Exchange Server 5.0 and also to direct users to an update for this additional affected platform. This update for Exchange 5.0 is a cumulative rollup package that also addresses the vulnerabilities in discussed in MS00-082 and MS01-041. You need only install this security update once to be protected against all three vulnerabilities.

What is the scope of this vulnerability?
In Exchange Server 5.0 and Exchange Server 5.5, this is a denial of service vulnerability because an unauthenticated attacker could exhaust large amounts of memory on the server or could cause the Internet Mail Service to shut down. There is no buffer that is overrun in this version of Exchange.
In Exchange 2000 Server, this is a buffer overrun vulnerability that could allow an unauthenticated attacker to exhaust large amounts of memory on the server or, at worst, run arbitrary code of their choice on the affected system in the security context of the Local System account.

What causes the vulnerability?
In Exchange Server 5.0 and Exchange Server 5.5, an unauthenticated attacker could issue a specially crafted SMTP extended verb request to allocate large amounts of memory.
In Exchange 2000 Server, an unauthenticated attacker could issue a specially crafted SMTP extended verb request to exploit an unchecked buffer.

What is SMTP?
SMTP (Simple Mail Transfer Protocol) is an industry standard for delivering e-mail over the Internet, as defined in RFC 2821 and in RFC 2822. The protocol defines the format of e-mail messages, the fields that are in e-mail messages, the contents of e-mail messages, and the handling procedures for e-mail messages.

What are SMTP extended verbs?
SMTP extended verbs are defined by the extension model that is defined in RFC 2821. They allow addition of new functionality to the SMTP protocol. Microsoft Exchange uses an extended verb to communicate routing and other Exchange-specific information among Exchange servers in an Exchange environment.

What is wrong with the way that Exchange handles SMTP extended verbs?
In Exchange Server 5.0 and Exchange Server 5.5, the Internet Mail Service does not require the authentication used between Exchange servers within an Exchange organization before it allows the use of an extended verb to transfer certain information among Exchange servers in the Exchange organization.
In Exchange 2000 Server, the SMTP service does not require the authentication used between Exchange servers within an Exchange organization before it allows the use of an extended verb to transfer certain information among Exchange servers in the Exchange organization. Additionally, the SMTP service does not correctly allocate a buffer for this information.

What would this vulnerability enable an attacker to do?
The vulnerability could allow an unauthenticated attacker to exhaust large amounts of memory on the server. This could cause a state where the server would stop responding to requests. In Exchange 2000 Server, the attacker could also, in the worst case, be able to cause remote code execution.

How could an attacker exploit this vulnerability?
An unauthenticated attacker could seek to exploit this vulnerability by connecting to an SMTP port on the Exchange server and by issuing a specially-crafted extended verb request. These requests can allocate memory on the server and can cause a denial of service. In Exchange 2000 Server, it is also possible to craft the request causing the SMTP service to fail in such a way that an attacker could execute code. This could allow an attacker to take any action on the system in the security context of the SMTP service. By default, the SMTP service runs as Local System.

Because Exchange 2000 Server uses the Windows 2000 SMTP service, does the vulnerability affect the SMTP service in Windows 2000?
No. The vulnerability does not affect the Microsoft SMTP service on systems that are running Windows 2000 that do not have Exchange 2000 Server installed.
The vulnerability also does not affect the Microsoft SMTP services that can be installed on Windows NT® Server 4.0 or on Windows XP.

Does the vulnerability affect the SMTP service in Exchange Server 2003?
No. The SMTP service in Exchange Server 2003 only accepts the SMTP extended verb request from Exchange servers within the same Exchange organization.

Can this be exploited directly by using e-mail?
No. This vulnerability could not be exploited by sending a specially-crafted e-mail message to a mailbox that is hosted on an Exchange server. An attacker would have to connect directly to the SMTP port on an Exchange server.

What does this patch do?
For Exchange Server 5.0 and Exchange Server 5.5 the patch removes the vulnerability by requiring that the authentication used between Exchange servers within an Exchange organization is used before an Exchange server accepts the SMTP extended verb requests.
For Exchange 2000 Server the patch removes the vulnerability by requiring that the authentication used between Exchange servers within an Exchange organization is used before an Exchange server accepts the SMTP extended verb requests. Additionally, this patch implements correct input validation in the affected buffer.

Does this patch introduce any behavioral changes?
Yes. In order to use the Exchange extended verb, the patch requires authenticated SMTP connections between Exchange servers within an Exchange organization.
Exchange servers automatically authenticate to other Exchange servers that are in the same Exchange organization. Therefore, Exchange servers typically do not require configuration changes.