Secunia

A vulnerability has been reported in Mail Transport System (MTS) Professional, which can be exploited by malicious people to use it as an open mail relay.

The vulnerability is caused due to an error in the SMTP service within the handling of banned IP addresses when the "MAIL FROM" header contains an e-mail address from the local domain. This can be exploited to relay mails through the SMTP service even when the IP address has been blocked.

Successful exploitation requires that the attacker connects from a banned IP address and that the service has been configured to only reject connections after the client has sent the "RCPT TO" command.

The vulnerability has been reported in MTS Professional with mtssmtp.exe version 1.61.1.84 and prior.

Solution
The vulnerability has been fixed in mtssmtp.exe version 1.61.1.85.
Further details available in Customer Area

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area