CVEvulnerability
CVE-2002-0054
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2002-03-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-294
Description
SMTP service in (1) Microsoft Windows 2000 and (2) Internet Mail Connector (IMC) in Exchange Server 5.5 does not properly handle responses to NTLM authentication, which allows remote attackers to perform mail relaying via an SMTP AUTH command using null session credentials.
Affected configurations
• microsoft exchange server 5.5
• microsoft windows 2000
Related
Weakness · CWE (1)
- CWE-294 Authentication Bypass by Capture-replay weakness
References
- http://marc.info/?l=bugtraq&m=101501580409373&w=2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/4205 Patch, Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-011 Patch, Vendor Advisory
- http://marc.info/?l=bugtraq&m=101501580409373&w=2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/4205 Patch, Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-011 Patch, Vendor Advisory