CVE-1999-0144: Low severity Qmail Project Qmail vulnerability
Denial of service in Qmail by specifying a large number of recipients with the RCPT command.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure qmail or a front-end SMTP proxy to reject or defer messages that specify an excessive number of RCPT commands (i.e., limit the number of recipients accepted per SMTP transaction) to prevent resource exhaustion from large recipient lists.
qmail maximum recipients per SMTP transaction = enforce a reasonable limit - Compensating control
Place an SMTP proxy, MTA wrapper, or network appliance (WAF/rate-limiter) in front of qmail and apply connection throttling and RCPT-rate limits; use firewall rules or connection limits to restrict abusive clients and mitigate denial-of-service caused by many RCPT commands.
- Operational
Monitor mail server logs for unusually high numbers of RCPT commands or recipient counts, and automatically block or rate-limit offending IPs; if an attack occurs, clear or pause affected mail queues and restart services as needed to recover.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0144?
CVE-1999-0144 is classified as a Denial of Service vulnerability.
How does CVE-1999-0144 affect Qmail?
CVE-1999-0144 affects Qmail by allowing an attacker to crash the server through excessive recipient specification.
What version of Qmail is vulnerable to CVE-1999-0144?
CVE-1999-0144 affects all versions of Qmail as it is related to how the RCPT command is handled.
How can I protect my Qmail server from CVE-1999-0144?
To protect against CVE-1999-0144, limit the number of recipients that can be specified in the RCPT command.
Is there a patch available for CVE-1999-0144?
There is no specific patch for CVE-1999-0144, but updating to a newer version of Qmail is recommended.