System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

SMTP Open Mail Relay vulnerability

Joel Pavon
Advisor

SMTP Open Mail Relay vulnerability

Hi!

I'm looking how can I fix the security issue abour "SMTP Open Mail Relay" on the reports whit tool called Foundstone i have the vulnerability CVE-1999-0512, the report don't explain how solve the problen.

Any body can help me??
7 REPLIES
Leandro Daniel Costa
Occasional Advisor

Re: SMTP Open Mail Relay vulnerability

Well, the SMTP Open Mail Relay vulnerability, is basically telling you that someone else, from another network is able to send mail using your SMTP server, so outsiders are able to for example, send spam through your server. To solve this problem, you should check your SMTP server's documentation, and for us to give a helping hand to you, we should at least know the product you're running [stmp server] and version.

Regards,
Leandro Daniel Costa
Joel Pavon
Advisor

Re: SMTP Open Mail Relay vulnerability

Sorry, but how can I know the version of SMTP??


Tnks.
Joel Pavon
Advisor

Re: SMTP Open Mail Relay vulnerability

I was run the command snmpd and this is the output of the command;

#snmpd
Start SNMP Master Network Management daemon
SNMP Research SNMP Agent Resident Module Version 14.2.1.7
Copyright 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 SNMP Research, Inc.


This is the version??
Ivan Ferreira
Honored Contributor

Re: SMTP Open Mail Relay vulnerability

Hi Joel, we are talking about SMTP, not SNMP. Don't worry, it's easy to mix the things.

What we need to know is what is your mail transfer agent (MTA), for example, sendmail, postfix, exim, etc.

One option to try to identify the information is to run:

telnet localhost 25

That "could" display server and version information.

Or, if you use an rpm based linux distro, run:

rpm -qa | grep -e "sendmail|postfix"
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?
Joel Pavon
Advisor

Re: SMTP Open Mail Relay vulnerability

This is the output of command.


#telnet localhost 25
Trying...
Connected to localhost.
Escape character is '^]'.
220 gamhap25. ESMTP Sendmail @(#)Sendmail version 8.13.3 - Revision 2.004 - 06/29/2006/8.9.3; Fri, 18 May 2007 09:50:56 -0500 (CDT)
Leandro Daniel Costa
Occasional Advisor

Re: SMTP Open Mail Relay vulnerability

Try this:

cat mysendmail.cf | grep FR-o

If it outputs something like this:

FR-o /etc/somefile

Then, you should edit /etc/somefile and set from which hosts you're willing to relay mail for, the most common setup for this, is to relay mail from localhost and from your local network. You have to put for example:

192.168.0.0/24
127.0.0.1

In that file and then send a SIGHUP to sendmail: killall -1 sendmail

Hope it helps
Ivan Ferreira
Honored Contributor

Re: SMTP Open Mail Relay vulnerability

Hola Joel, please see:

http://www.usebox.net/jjm/sendmail/#relay

Que viva el tequila!
Por que hacerlo dificil si es posible hacerlo facil? - Why do it the hard way, when you can do it the easy way?