Title: Malformed Mail Attribute can Cause Exchange 2000 to
Exhaust CPU Resources (Q320436)
Date: 29 May 2002
Software: Microsoft Exchange
Impact: Denial of Service
Max Risk: Critical
Bulletin: MS02-025

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS02-025.asp.

Issue:

To support the exchange of mail with heterogeneous systems,
Exchange messages use the attributes of SMTP mail messages that
are specified by RFC's 821 and 822. There is a flaw in the way
Exchange 2000 handles certain malformed RFC message attributes
on received mail. Upon receiving a message containing such
a malformation, the flaw causes the Store service to consume
100% of the available CPU in processing the message.

A security vulnerability results because it is possible for an
attacker to seek to exploit this flaw and mount a denial of
service attack. An attacker could attempt to levy an attack
by connecting directly to the Exchange server and passing a
raw, hand-crafted mail message with a specially malformed
attribute. When the message was received and processed by the
Store service, the CPU would spike to 100%. The effects of the
attack would last as long as it took for the Exchange Store
service to process the message. Neither restarting the service
nor rebooting the server would remedy the denial of service.

Mitigating Factors:

• The effect of an attack via this vulnerability would be
  temporary. Once the server completed processing the
  message, normal operations would resume. However, it
  is not possible to halt the processing of the message
  once begun, even with a reboot.

• The vulnerability does not provide any capability to
  compromise data on the server or gain administrative
  control over it.

• Mounting a successful attack requires the ability to pass a
  hand-crafted message to the target system, most likely through
  a simulated server-based connection. It is not possible to
  craft a malformed message using an email client such as
  Outlook or Outlook Express.

Risk Rating:

• Internet systems: Critical
• Intranet systems: Critical
• Client systems: None

Patch Availability:

• A patch is available to fix this vulnerability. Please read the
  Security Bulletin at
  http://www.microsoft.com/technet/security/bulletin/ms02-025.asp
  for information on obtaining this patch.

Acknowledgment:

• Mr. Allendoerfer ([email protected]);
  Mr. Koenig ([email protected]);
  Mr. Kraemer ([email protected]);
  Mr. Schaal ([email protected]);
  Mr. Tacke ([email protected]) of the Computing Center,
  Johannes Gutenberg University Mainz, Germany

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR
ITS
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES DO
NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
OR
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.