{"vuid":"VU#176972","idnumber":"176972","name":"Lotus Domino SMTP Server Allows Anonymous Relay of Quoted Addresses","keywords":["Lotus","Domino","SMTP","notes","SMTPMTA","Anonymous","spam","security"],"overview":"Lotus Domino includes an SMTP server. Under certain configurations, an intruder may be able to relay mail to third parties through the Domino SMTP server.","clean_desc":"An \"open\" mail server is one that will send mail that is not addressed to and does not originate from a local user. Open mail servers are sometimes called \"open mail relays\", \"mail relays\", \"third-party mail servers\" or similar names. Intruders who wish to conceal their true location often send mail through an open mail server. For more information on open mail servers, see http://maps.vix.com/tsi/ar-what.html Lotus Domino includes anti-relay provisions to prevent intruders from sending mail through a Domino SMTP server to third parties. However, by carefully constructing a mail message, an intruder can circumvent the safeguards provided by Domino, effectively turning Domino SMTP server into an open mail relay. A portion of an SMTP dialog showing exploitation of this vulnerability may appear as follows: 220 mailserver.example.org Lotus SMTP MTA Service Ready\nhelo attacker.org\n250 kb.cert.org\nmail from: spoofed_address@apparently-valid-site.com\n250 OK\nrcpt to: <\"attacker@attacker.org, third-party@thirdparty.org\"@example.org>... Recipient ok\n250 OK Mail in this case may be delivered to third-party@thirdparty.org, apparently from  spoofed_address@apparently-valid-site.com in violation of example.org's rules against the relaying of mail. We have received reports indicating this attack is being actively used by intruders and provide this information to assist in the development of safeguards.","impact":"Intruders can use Lotus Domino SMTP servers to relay mail to arbitrary third parties.","resolution":"Apply an update from Lotus when it is available. Lotus is tracking this issue as SPR# MLOT4THVGP. See their vendor statement for additional information.","workarounds":"Until an update is available, you can avoid this problem through several techniques. First, you can use the anti-relay facilities provided by Domino. By putting a \"*\" in the \"Deny messages from external Internet domains to be sent to the following Internet domains\" field you can prevent mail originating externally from being delivered to a third-party site. Second, a third-party mail server (such as sendmail) may be able to filter out certain types of messages. For sendmail 8.10 and later, it has been reported that editing /etc/mail/sendmail.cf file and  changing the line that reads \"Kdequote dequote\" to \"Kdequote dequote -S\" stops attempts to exploit this weakness.","sysaffected":"","thanks":"Our thanks to Kreigh Tomaszewski, James Kersjes, Joe McMahon and Al Wever of Alticor, Inc., and Richard Rongle of Sendmail, Inc., for reporting this problem and providing technical assistance.","author":"This document was written by Shawn V. Hernan","public":["h","t","t","p",":","/","/","m","a","p","s",".","v","i","x",".","c","o","m","/","t","s","i","/","a","r","-","w","h","a","t",".","h","t","m","l"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2001-02-02T20:17:38Z","publicdate":"2001-03-01T00:00:00Z","datefirstpublished":"2001-03-02T15:47:39Z","dateupdated":"2001-03-11T03:46:39Z","revision":8,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"18","cam_exploitation":"12","cam_internetinfrastructure":"5","cam_population":"10","cam_impact":"1","cam_easeofexploitation":"20","cam_attackeraccessrequired":"20","cam_scorecurrent":"2.625","cam_scorecurrentwidelyknown":"2.775","cam_scorecurrentwidelyknownexploited":"3.375","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":2.625,"vulnote":null}