topic Re: Problems with SMTP after latest Vuln Profile update? in General Topics

Problems with SMTP after latest Vuln Profile update?

bradenmcg — Thu, 17 Feb 2011 22:55:14 GMT

Anyone else seeing a bunch of their SMTP connections blocked by this signature after the latest update?

Name:	SMTP EHLO/HELO overlong argument anomaly
ID:	30384
Description:	This anomaly would be triggered when an overlong parameter is sent to the HELOcommand of SMTP protocol. Some servers such as Tabs Laboratories MailCarrier2.51 might be prone to an overflow vulnerability while parsing the craftedrequest.A successful attack could lead to remote code execution with the privileges of the current logged-in user.

I don't use any of the affected software so I am going to whitelist that ID, but the fact that it was just added to the system and caused me problems seemed to be something that shouldn't happen...

Re: Problems with SMTP after latest Vuln Profile update?

rapoint_person — Fri, 18 Feb 2011 08:17:48 GMT

What version are we talking about?

Re: Problems with SMTP after latest Vuln Profile update?

bradenmcg — Fri, 18 Feb 2011 17:04:28 GMT

232-884

Apps, Threats

Full

12 MB

2011/02/15 10:46:28

I believe I'm seeing it in relation to a recent SSL cert update I installed on my mail and anti-spam units (both of which do send outbound mail as well). I don't know if the latest threat update is at fault; it may happen with the previous releases as well (but I don't want to roll back right now to test).

The new cert is a wildcard cert from DigiCert, and I have several subject alternative names (SANs) on it, which make the whole thing much longer than a standard cert when it is presented in an SMTP HELO/EHLO.

The vuln profile itself may not actually be at "fault" here in that it may not be the newest version causing the problem... however, a completely legit EHLO responding to a STARTTLS request shouldn't be triggering the profile to block traffic.

Re: Problems with SMTP after latest Vuln Profile update?

rapoint_person — Fri, 18 Feb 2011 18:36:51 GMT

Yep, Sounds like it should be related to your certificate. The CVE is old, so I guess this is an issue in the previous version/versions as well. I think you may need to dive in to the release notes and se what has changed if no one else here can aid. If all else fails open a case. Would like to hear how things turn out though!

Btw, Do you know for a fact that your server is subject for the threat mentioned? If not, start by exempting the threat-id until it is resolved.