CVE-1999-1043: Medium severity Microsoft Exchange Server vulnerability
Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data, or (2) malformed SMTP data, which allows remote attackers to cause a denial of service (application error).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If NNTP is not required, disable the NNTP service on affected Exchange servers to prevent processing of malformed NNTP data that can cause application errors/DoS.
Microsoft Exchange Server (NNTP service) NNTP service = disabled - Configuration
Restrict SMTP acceptance to trusted hosts or networks where possible (limit which IPs/networks may establish SMTP connections) to reduce exposure to malformed SMTP data.
Microsoft Exchange Server (SMTP service) SMTP listener/accept policy = restrict to trusted hosts/networks - Compensating control
At the network perimeter, restrict access to NNTP and SMTP ports using firewall rules or ACLs so only trusted IP ranges or relay hosts can connect.
- Compensating control
Deploy network-level filtering/IDS/IPS or mail-gateway filtering to detect and block malformed NNTP/SMTP traffic patterns that could trigger application errors.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1043?
CVE-1999-1043 is classified as a denial of service vulnerability affecting Microsoft Exchange Server 5.5 and 5.0.
How do I fix CVE-1999-1043?
To mitigate CVE-1999-1043, it is recommended to upgrade to a supported version of Microsoft Exchange Server that is not affected.
Which software versions are impacted by CVE-1999-1043?
CVE-1999-1043 affects Microsoft Exchange Server versions 5.5 and 5.0.
What type of attack does CVE-1999-1043 allow?
CVE-1999-1043 allows remote attackers to exploit malformed NNTP or SMTP data to cause application errors.
Is CVE-1999-1043 still a concern for current systems?
CVE-1999-1043 is primarily a concern for legacy systems still running Microsoft Exchange Server 5.5 or 5.0.