PT-2002-1146 · Microsoft · Windows 2000+1

Published 2002-03-08 · Updated 2020-04-09 · CVE-2002-0054

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Windows 2000 Exchange Server 5.5

Description The issue arises from the SMTP service's improper handling of responses to NTLM authentication. This allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.

Recommendations For Microsoft Windows 2000, apply the necessary security updates to address the issue. For Exchange Server 5.5, consider restricting access to the SMTP AUTH command until a patch is available.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2002-0054

Affected Products

Exchange 5.5 Server

Windows 2000

References · 5

• http://securityfocus.com/bid/4205 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0054 · Security Note
• http://marc.info/?l=bugtraq&m=101501580409373&w=2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0054 · Note