Is Messaging Gateway affected by CVE-1999-0512

Products

• Messaging Gateway

Issue/Introduction

A vulnerability scan of Messaging Gateway (SMG) indicates that Messaging Gateway is configured as an open SMTP relay.

CVE-1999-0512 Description: A mail server is explicitly configured to allow SMTP mail relay, which allows abuse by spammers.

Environment

Messaging Gateway

Cause

The Outbound SMTP interface on Messaging Gateway is configured as a trusted relay for the internal customer network. This is by design and access to the Outbound MTA is limited by an access control list (ACL).

Resolution

This entry in a vulnerability scan is a false positive.

The Outbound MTA on Messaging Gateway is configured as a trusted relay for all networks configured in the Outbound Mail Acceptance list.

To update the Outbound Mail Acceptance list

1. Log into the Messaging Gateway Control Center as an admin with at least Modify Configuration rights
2. Go to Administration > Configuration > host > SMTP > Outbound
3. Add or remove networks and IPs to the Outbound Mail Acceptance list as needed
4. Select Apply above settings to all scanners if desired
5. Click Save