full-disclosure - Verisign's SiteFinder also breaks Outlook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004b01c37fab$464b9700$550ffea9@rms>
From: rms at computerbytesman.com (Richard M. Smith)
Subject: Verisign's SiteFinder also breaks Outlook

Hello,

I have discovered that VeriSign's SiteFinder service also breaks
Microsoft's Outlook email reader.  If a user misspells a domain name in
their POP3 or SMTP server name, Outlook no longer provides meaningful
error messages to a user to help them understand and fix the problem.

Here is the standard message from Outlook for a misspelled domain name
in a POP3 or SMTP server name:

   Task 'pop.rcn.com - Sending and Receiving' 
   reported error (0x800CCC0D) : 'Unable to find 
   the e-mail server.  Please verify the server 
   information in your account properties.'

With SiteFinder turned on, here's what happens:

   [POP]
   Task 'pop.rcn.com - Sending and Receiving' reported 
   error (0x80042108) : 'Outlook is unable to connect 
   to your incoming (POP3) e-mail server. If you continue 
   to receive this message, contact your server 
   administrator or Internet service provider (ISP).'

   [SMTP]
   Your message did not reach some or all of the 
   intended recipients.
    The following recipient(s) could not be reached:

      'rms@...puterbytesman.com' on 9/20/2003 3:04 PM
      550 <unknown[24.91.207.165]>: Client host 
      rejected: The domain you are trying to send mail 
      to does not exist.

The error message for the SMTP domain misspelling is the worse of the
two, because the error message states that the domain name in the email
address is bad and not the domain name of the SMTP email server.

Richard M. Smith
http://www.ComputerBytesMan.com