Penetration Testing mailing list archives
RE: MS99-027 - New IIS problem?
From: Lucas <Lucas () dnsys com>
Date: Tue, 9 Jul 2002 10:54:15 -0500
Did you make sure they even have access restrictions in place on the SMTP service (They're probably not even using it, in which case I assume you'll disable it.)? What happens if you simply try using the web server's IP address as a SMTP server and send yourself a test message? -Lucas -----Original Message----- From: Jason [mailto:cisspstudy () yahoo com] Sent: Monday, July 08, 2002 1:12 AM To: pen-test () securityfocus com Subject: MS99-027 - New IIS problem? I was recently doing a penetration test and noticed a problem with the SMTP component of their web server that allowed me to relay mail using an old SMTP encapsulation problem. I traced it back to the MS bulletin MS99-027. This bulletin mentions relaying problems with MS Exchange 5.5 IMS connector. It appears that this same problem also occurs with the SMTP service that ships with IIS 4. The installation appears to be running SP6a, Security Post rollup service pack and the latest patches up to MS02-018 (Q319733) that contains cumulative patches for IIS, but this does not appear to fix the problem at hand. What patch do I need to install to fix this problem? There is no mention of an IIS patch in the MS99-027 bulletin. Was this originally thought to not affect IIS? Jason ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/ ---------------------------------------------------------------------------- This list is provided by the SecurityFocus Security Intelligence Alert (SIA) Service. For more information on SecurityFocus' SIA service which automatically alerts you to the latest security vulnerabilities please see: https://alerts.securityfocus.com/
Current thread:
- MS99-027 - New IIS problem? Jason (Jul 08)
- Re: MS99-027 - New IIS problem? Tom Fischer (Jul 13)
- Re: MS99-027 - New IIS problem? Jason binger (Jul 15)
- <Possible follow-ups>
- RE: MS99-027 - New IIS problem? Lucas (Jul 11)
- Re: MS99-027 - New IIS problem? Tom Fischer (Jul 13)