Rule:--Sid:1450--Summary:This event is generated when an attempt is made to send a malformedrequest to an SMTP server which may cause a Denial of Service.--Impact:Denial of Service (DoS)--Detailed Information:The SMTP standard command "EXPN" is provided by servers to help finduser e-mail accounts.A malformed request to certain versions of Vintra MailServer can cause aDoS against that server. --Affected Systems:Vixar MailServer for Windows--Attack Scenarios:The attacker needs to connect to a vulnerable server and issue thefollowing commands.>telnet victim.foo.com 25>helo victim>mail from:doctor>rcpt to:evil>expn *@--Ease of Attack:Simple. No exploit software required.--False Positives:None known.--False Negatives:None known.--Corrective Action:Disable the EXPN command on the SMTP server.Upgrade to the latest non-affected version of the software--Contributors:Sourcefire Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>Extra information from Nawapong Nakjang (tony@ksc.net, tonie@thai.com)--Additional References:NT Bugtraq:http://marc.theaimsgroup.com/?l=ntbugtraq&m=90222454131610&w=2Command Reference:http://www.ntmail.co.uk/kb.htm?q=980--