CVE-2002-0698

Vulnerability

A buffer overflow exists in the Internet Mail Connector (IMC) component of Microsoft Exchange Server 5.5. When the IMC receives an SMTP EHLO (extended hello) command from a remote server, it constructs a response that includes the connecting server's fully-qualified domain name, obtained via a reverse DNS lookup. If that name exceeds a certain length, the response overflows a fixed-size buffer in the IMC code. The vulnerability is documented in Microsoft Security Bulletin MS02-037 [1]. All versions of Exchange 5.5 running the IMC are affected [1].

Exploitation

An attacker must control a system whose reverse DNS record points to a long hostname (exceeding the expected buffer size), then send an EHLO command from that system to the Exchange server. No prior authentication or special network position is required beyond the ability to establish an SMTP connection. The IMC performs a reverse DNS lookup on the connecting IP, retrieves the crafted long name, and includes it in the EHLO response, which overflows the buffer. The attacker must populate the long hostname with carefully chosen data to achieve code execution [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code with the privileges of the Exchange 5.5 service account, which typically has broad system-level access. The impact is complete compromise of the Exchange server, including the ability to read, modify, or delete email data and potentially to pivot to other hosts on the network. If overflowed with random data, the IMC fails, resulting in a denial of service [1].

Mitigation

Microsoft released a security update (Q326322) on July 25, 2002, as part of MS02-037 [1]. Administrators should apply the patch to all Exchange 5.5 servers running the IMC. No workarounds are documented in the bulletin, and the product is long past its support lifecycle, so upgrading to a supported Exchange version or disabling the IMC if not required are recommended. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing.