Restricting VRFY and EXPN SMTP commands - Messaging Gateway

Products

• Messaging Gateway

Issue/Introduction

Security administrators may be asked to disable or restrict VRFY and EXPN commands during penetration testing or vulnerability assessments.

This article explains the default behavior of these commands within the Messaging Gateway (SMG).

Environment

Messaging Gateway 10.7 / 10.8 / 10.9

Cause

Some penetration testing can interpret 252 2.0.0 SMTP response from the SMG as a allowed command by seeing a response.

Resolution

VRFY and EXPN commands are restricted by default in Messaging Gateway versions 10.7, 10.8, and 10.9.

The system intentionally returns a '252 2.0.0... restricted' response to these requests. No configuration changes are required to secure the appliance against these commands, as they are not usable for unauthorized reconnaissance.