PT-2002-1146 · Microsoft · Windows 2000+1

Publicado 2002-03-08 · Atualizado 2020-04-09 · CVE-2002-0054

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 Exchange Server 5.5

Description The issue arises from the SMTP service's improper handling of responses to NTLM authentication. This allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.

Recommendations For Microsoft Windows 2000, apply the necessary security updates to address the issue. For Exchange Server 5.5, consider restricting access to the SMTP AUTH command until a patch is available.

Correção

Enumeração de Fraquezas

CWE-294

Identificadores relacionados

CVE-2002-0054

Produtos afetados

Exchange 5.5 Server

Windows 2000

Referências · 5

• http://securityfocus.com/bid/4205 · Correção
• http://marc.info/?l=bugtraq&m=101501580409373&w=2 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-011 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0054 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0054 · Nota