TITLE:
Mail Transport System Professional Mail Relay Vulnerability

SECUNIA ADVISORY ID:
SA19067

VERIFY ADVISORY:
http://secunia.com/advisories/19067/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass

WHERE:
>From remote

SOFTWARE:
Mail Transport System (MTS) Professional 1.x
http://secunia.com/product/8463/

DESCRIPTION:
A vulnerability has been reported in Mail Transport System (MTS)
Professional, which can be exploited by malicious people to use it as
an open mail relay.

The vulnerability is caused due to an error in the SMTP service
within the handling of banned IP addresses when the "MAIL FROM"
header contains an e-mail address from the local domain. This can be
exploited to relay mails through the SMTP service even when the IP
address has been blocked.

Successful exploitation requires that the attacker connects from a
banned IP address and that the service has been configured to only
reject connections after the client has sent the "RCPT TO" command.

The vulnerability has been reported in MTS Professional with
mtssmtp.exe version 1.61.1.84 and prior.

SOLUTION:
The vulnerability has been fixed in mtssmtp.exe version 1.61.1.85.

Users can contact the vendor to obtain an update.

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------