MS99-027 - New IIS problem?

[Jason <cisspstudy () yahoo com>]

I was recently doing a penetration test and noticed a problem with the 
SMTP component of their web server that allowed me to relay mail using an 
old SMTP encapsulation problem.

I traced it back to the MS bulletin MS99-027. This bulletin mentions 
relaying problems with MS Exchange 5.5 IMS connector. It appears that this 
same problem also occurs with the SMTP service that ships with IIS 4.

The installation appears to be running SP6a, Security Post rollup service 
pack and the latest patches up to MS02-018 (Q319733) that contains 
cumulative patches for IIS, but this does not appear to fix the problem at 
hand.

What patch do I need to install to fix this problem? There is no mention 
of an IIS patch in the MS99-027 bulletin. Was this originally thought to 
not affect IIS?

Jason



----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/