CVE-1999-1532: Medium severity Netscape Messaging Server vulnerability
Netscape Messaging Server 3.54, 3.55, and 3.6 allows a remote attacker to cause a denial of service (memory exhaustion) via a series of long RCPT TO commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the messaging server or an SMTP front-end to enforce a maximum RCPT TO command length and reject RCPT TO commands that exceed that limit to prevent memory exhaustion from long RCPT TO input.
Sun iPlanet Messaging Server (Netscape Messaging Server) RCPT TO command length handling = reject or limit long RCPT TO commands - Compensating control
At the network perimeter, restrict and filter access to the SMTP service (TCP/25) to trusted hosts only; implement connection rate-limiting and perimeter filtering/WAF rules to drop or terminate sessions that send abnormally long or excessive RCPT TO commands.
- Operational
If memory exhaustion occurs, restart the messaging service to recover memory and review logs to identify and block sources sending long RCPT TO commands; monitor for repeat attempts and apply network filtering until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1532?
CVE-1999-1532 has a high severity as it allows remote attackers to cause a denial of service through memory exhaustion.
How do I fix CVE-1999-1532?
To fix CVE-1999-1532, upgrade to a version of Netscape Messaging Server that is not affected, such as a later version beyond 3.6.
Which versions of Netscape Messaging Server are affected by CVE-1999-1532?
CVE-1999-1532 affects Netscape Messaging Server versions 3.54, 3.55, and 3.6.
What type of attack does CVE-1999-1532 involve?
CVE-1999-1532 involves a denial of service attack through a series of long RCPT TO commands.
Is CVE-1999-1532 still a significant threat today?
While CVE-1999-1532 is an older vulnerability, systems that still use affected versions remain at risk.