Vulnerability in Microsoft Exchange Server

CVE-2002-0054

SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.

EPSS: 0.224 (97.5th percentile) — read the EPSS interpretation.

Affected products

Microsoft Exchange_server — versions 5.5
Microsoft Windows_2000
N/a — versions n/a

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, Mailing List, Third Party Advisory)
cve@mitre.org (x_refsource_MS, vendor-advisory, Patch, Vendor Advisory)
cve@mitre.org (Patch, VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)