Hey guys, I have tried allowing the scanners IP to be accepted through IPTABLES into the SMTP port, but the scan still fails.
This is the error: The remote SMTP server is vulnerable to a buffer overflow.
The SMTP server doesn't even crash. I have tried white listing the IP in Exim but the scanner still gives the server and says the server is vulnerable to open relay. This is on a CentOS cPanel/WHM server. I have also enabled the SMTP tweak.
Does anyone know how to fix this?
Thanks
The result from your PCI scanning service is likely a false positive, though it can be hard to tell. Chances are they matched the version number of your SMTP program, it usually is announced on connection to port 25, and checked that product and version number against a list of known-vulnerable software. And found a match.
Since you are on Centos, the thing you need to do is go through the entire revision history of the SMTP service's RPM releases looking for a changelog that specifies security fixes. Chances are very good that RedHat has backported the buffer overflow vulnerability into the older revision, but you need to backtrack to be certain. Once that's done, you can flag this as a false positive.
Backporting of security patches is one of the main benefits of using a Linux with a support contract. Centos is the same thing, but you don't get to call in about anything you just get security patches.
Just an extension to @sysadmin1138 but you need to find the CVE number they provided for the vulnerability (likely CVE-200something-numbers). Google for that vulnerability and click on any link that says "RedHat", "CentOS" or even at a push "Fedora". That page will tell you if it was resolved, and in which versions it was resolved. Check your version of Exim against this and then explain your findings to the ASV who will mark it was a false positive.
You might be unlucky with it being CPanel (and not using standard repositories if I remember rightly).
Likely a false positive based only on the version string returned in the connection response. It has likely already been patched in your particular version. You haven't mentioned which scanner you use, but it likely didn't actually try to exploit a buffer overflow - it's just basing what it sees on a database of versions and vulnerabilities.
** EDIT: THIS IS INCORRECT - SORRY: Also - the last time I read the specs (about 3 years ago) PCI compliance does not mean that you must pass any particular vulnerability scanning tool's tests - it only requires that you have procedures in place to do regular scanning and address issues, and the management controls to ensure that happens. **
I just reviewed the latest documents, and scanning by a compliant ASV appears to now be required. I may have misremembered, or it may have changed, either way, you're stuck with an outside company.
Did you actually fail a PCI audit, or is this just a service that claims to be a "PCI Compliant" scanner. Side note - have you read the revelant sections of PCI? If not, you should - it's not that bad.
Whatever scanner is telling you this, it should be giving you a vulnerability reference number from some publicly accessible vulnerability database. Give that a read, and then verify whether the package you have installed has that particular vulnerability patched or not, and then document that fact, and move on.
If you're paying an outside auditing firm to prepare you for a PCI audit and they aren't giving you these details, you should ask for them - and if they won't give them, run nessus yourself, it will tell you.
The open relay is correct - the external scanner service assumes it has the same view of your network as the rest of the internet. If you whitelist it, it's allowed to relay, and is going to assume everyone else is too. If port 25 is normally blocked to the public, then you should leave it blocked for the purposes of the scan - it's part of your security.
Wait which error are you getting, and what scanner is being used against your mail server? eEye Retina? Nessus?
In one sentence you say: "This is the error: The remote SMTP server is vulnerable to a buffer overflow."
...later in your question you say "I have tried white listing the IP in Exim but the scanner still gives the server and says the server is vulnerable to open relay."
Those are two completely different scanner findings... whitelisting the scanner IP in Exim would actually make your problem worse, not better. If you whitelist the IP of the scanner, it will think it can open relay through SMTP, which is a common problem with SMTP servers that spammers take advantage of.
A buffer overflow more often than not result in account compromise for the user running the daemon in question. Buffer overflows are sometimes Denial of Service but typically not and often end up being system level compromise after further research is done. If actually an issue, this can be a big deal. I would rank it between medium and high depending where it touches my infrastructure and the size of the footprint.
You are going to need to verify two core things:
I have found with Scan Alert (now McAfee) rarely produce false positives. Unless your Approved Scanner Vendor has a history of false positives, I would assume that it is a legitimate vulnerability until you prove otherwise.
If vulnerable, it should be easy enough to locate a supported patch for your distribution.
