SMTP Mail Forgery Vulnerability

fischste

unread,

Oct 10, 2006, 11:56:01 AM10/10/06

to

I have a low risk vulnerability on an Exchange server. The report states the
SMTP server accepts any domain name in the HELO command. What can I do to
correct this issue?

Thanks

Mark Arnold [MVP]

unread,

Oct 10, 2006, 1:09:01 PM10/10/06

to

Which report is this then?

fischste

unread,

Oct 10, 2006, 1:26:01 PM10/10/06

to

This report came form an outside network security company who runs Secure
Scout and generates a monthly vulnerability assessment report. The report
states it is a low risk vunerability because the HELO command accepts a fake
domain name. I hope this answers your question.

Ed Crowley [MVP]

unread,

Oct 10, 2006, 2:36:08 PM10/10/06

to

Don't worry about it.
--
Ed Crowley
MVP - Exchange
"Protecting the world from PSTs and brick backups!"

"fischste" <fisc...@discussions.microsoft.com> wrote in message
news:3686272A-AAAD-4824...@microsoft.com...

fischste

unread,

Oct 10, 2006, 2:53:03 PM10/10/06

to

I would like to not worry about it but what can I tell my client who is a
financial institution and has bank auditors reading these vulnerability
reports?

Ed Crowley [MVP]

unread,

Oct 10, 2006, 3:14:59 PM10/10/06

to

Tell them not to worry about it.

--
Ed Crowley
MVP - Exchange
"Protecting the world from PSTs and brick backups!"

"fischste" <fisc...@discussions.microsoft.com> wrote in message

news:0D71D544-B04A-41B2...@microsoft.com...

Peter Lawton

unread,

Oct 10, 2006, 3:42:31 PM10/10/06

to

Did they say what HELO domain names they expect you to accept?

You can't insist that the HELO matches the sender email domain as it often
doesn't, the SMTP RFCs aren't very strict about what a HELO can and can't
be.

What you could do is use some 3rd party software that can filter on HELO and
insist that it's RFC compliant, plus a lot of other criteria, however banks
often get very paranoid that they might be rejecting legitimate email.
As with most filtering for spam etc you can never achieve a 100% block rate
with a 0% false positive rate, it's always a balance made depending on your
circumstances. Banks usually go for 0% false positives and won't even
publish SPF/Sender ID records (which is a shame as they're the ones who
suffer from most phishing attacks.

You can probably head the auditors off if you point out that although you
can impliment very strict SMTP acceptance rules you will inevitably end up
rejecting some legitimate email ;-)

Peter Lawton

"fischste" <fisc...@discussions.microsoft.com> wrote in message

news:0D71D544-B04A-41B2...@microsoft.com...

James Chong

unread,

Oct 10, 2006, 4:02:02 PM10/10/06

to

>Did they say what HELO domain names they expect you to accept?

Good question, I'm wondering if the message from the report is really
saying that it's not validating HELO lookups rather than it's accepting
any domain name.

James Chong

fischste

unread,

Oct 11, 2006, 10:11:03 AM10/11/06

to

James,
The "solution" in the report states the SMTP server should check if the
information received in the HELO command is vaild. They sent the following
command to the server, "HELO Fake_Domain" and the server responded to the
command.

Pedro Leite

unread,

Oct 11, 2006, 10:48:03 AM10/11/06

to

good afternoon

sorry, but i couldnt resist.

the " solution " reminded me a joke :

there was this guy on a hot air ballon, lost over a city. when he was over a
roof top, he shouted to the lady on it : " PLEASE, TELL ME WHERE I AM ?? "
she said, well, you are inside the basket of a hot air ballon, hovering at
about 150 ft over the whatever corp building, roughly at 42º 45' N and 12º
76' W.
he says, thank yooouuu very much, i bet you are a technician. you gave me a
totally technically correct answer but made me waste my time and i am no
better that before, actually, i'm even worse as i can't figure out how to
land.
hmmmmm, she says, i bet you are a manager, i gave a technically correct
answer. all the data was accurate. you didn't understand any of it. your
situation is no better that before, and somehow, it already my fault !!!!!

insist with them. if they audit, they must also give corrective feedback.
what should be the proper reply and action to fake_domain.

cheers

Pedro Leite from Portugal.

-------------------------------------------------------------
"fischste" <fisc...@discussions.microsoft.com> escreveu na mensagem
news:AAC8CBB7-0B7F-4FDD...@microsoft.com...

Peter Lawton

unread,

Oct 11, 2006, 2:58:16 PM10/11/06

to

Well, if you want to do some heavy filtering on SMTP try ORF, you can filter
on HELO plus a lot more. Really excellen product, we use it for all our spam
filtering.

www.vamsoft.com

Peter Lawton

"fischste" <fisc...@discussions.microsoft.com> wrote in message

news:AAC8CBB7-0B7F-4FDD...@microsoft.com...