Is CVE-1999-0250 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-0250 being exploited in the wild.

How severe is CVE-1999-0250?

Critical severity, with a CVSS score of 10, published 1 July 1997.

Is there a fix for CVE-1999-0250?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-0250 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-1999-0250?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-0250: qmail memory exhaustion denial of service via RCPT commands

CVE-1999-0250 · Severity: critical · CVSS 10 · Published 1997-07-01

A vulnerability in the qmail email server allows a remote attacker to crash the system or make it unresponsive. By sending an excessive number of recipient addresses in a single email transaction, an attacker can exhaust the server's memory and swap space. This results in a total denial of service, preventing the organization from sending or receiving legitimate email and potentially impacting other services on the same host.

Quick answers

Is CVE-1999-0250 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-0250 being exploited in the wild.
How severe is CVE-1999-0250?: Critical severity, with a CVSS score of 10, published 1 July 1997.
Which products and versions are affected?: qmail qmail 1.0 and earlier.
Is there a fix for CVE-1999-0250?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-0250 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-1999-0250?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The qmail-smtpd component fails to impose a configurable upper bound on the number of RCPT commands accepted per message. A remote, unauthenticated attacker can establish an SMTP connection and transmit an infinite stream of 'RCPT TO' commands. Because qmail-smtpd dynamically allocates memory to track these recipients, the process will eventually consume all available physical memory and swap space on the host. This leads to a denial of service (DoS) through resource exhaustion. While the vendor argued that system-level resource limits (rlimits) should be used to mitigate such issues, the lack of application-level enforcement allows for trivial exploitation on default configurations.

Affected products

qmail qmail 1.0 and earlier

Timeline

1997-06-11: disclosed: Vulnerability details and proof-of-concept code shared on the qmail mailing list.
1997-07-01: advisory: NVD published the CVE record.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.