It was possible to crash the affected SMTP service by sending a VRFY command with a long argument. 

This attack is known to affect certain versions of Ipswitch IMail and Seattle Labs' SLMail, although products from other vendors may also be affected. 

An unauthenticated, remote attacker can leverage this issue to conduct a denial of service attack against the affected mail server.

The remote SMTP server answers to the EXPN and/or VRFY commands.

The EXPN command can be used to find the delivery address of mail aliases, or even the full name of the recipients, and the VRFY command may be used to check the validity of an account.

Your mailer should not allow remote users to use any of these commands, because it gives them too much information.

Nessus has detected that the remote SMTP server allows anyone to use it as a mail relay provided that the source address is set to '<>'.
This issue allows any spammer to use your mail server to send their mail to the world, thus flooding your network bandwidth and possibly getting your mail server blacklisted.

It was possible to perform a denial of service against the remote SMTP server by sending it two HELO commands followed by a too long argument.  This allows an unauthenticated, remote attacker to deny service to legitimate users of the server.

It was possible to crash the remote SMTP server by sending a too long argument to the HELO command.  This allows an unauthenticated, remote attacker to deny service to legitimate users of the server. 

It may also indicate the service is affected by a buffer overflow vulnerability which, if true, would allow an attacker to execute arbitrary code on the affected host, subject to the privileges under which the service operates.

The remote host appears to be running NetManage Chameleon SMTPd.

This version of the software has a remote buffer overflow vulnerability. Nessus crashed the service by issuing a long argument to the HELP command. A remote attacker could exploit this issue to crash the service, or possibly execute arbitrary code.

There is also a buffer overflow related to the HELO command, but Nessus has not checked for this issue.

ID	Name	Severity
10254	Ipswitch IMail / SLMail VRFY Command Remote Overflow	medium
10249	Multiple Mail Server EXPN/VRFY Information Disclosure	medium
10167	NTMail3 Arbitrary Mail Relay	high
10162	Lotus Notes SMTP Server HELO Command Overflow DoS	medium
10136	MDaemon SMTP HELO Command Remote Overflow DoS	high
10042	NetManage Chameleon SMTPd Remote Overflow DoS	critical

Detections

Analytics

SMTP problems Family for Nessus

medium

medium

high

medium

high

critical