How to remediate – SMTP Server Non-standard Port Detection

1. Introduction

The SMTP Server Non-standard Port Detection vulnerability means your Simple Mail Transfer Protocol service is listening on a port other than the standard 25, 465, or 587. This could indicate a deliberately hidden backdoor installed by an attacker to relay spam or gain control of the server. Affected systems are typically mail servers running Windows Server, Linux distributions with Postfix, Sendmail, or Exim, and any other system hosting an SMTP service. A successful exploit could compromise confidentiality, integrity, and availability of the server.

2. Technical Explanation

This vulnerability occurs when an administrator intentionally or unintentionally configures the SMTP service to listen on a non-standard port. Attackers use this to evade standard network monitoring tools and potentially hide malicious activity. An attacker could send emails through your server without being easily detected. There is no specific CVE associated with simply *running* on a non-standard port, but it’s often an indicator of compromise.

• Root cause: Incorrect SMTP service configuration using a port other than the standard ports (25, 465, or 587).
• Exploit mechanism: An attacker identifies the non-standard port and uses it to relay spam emails or attempt further exploitation of the server. For example, they might connect with an email client configured for that port and send test messages.
• Scope: All systems running SMTP services are potentially affected, including Windows Server (with Microsoft Exchange), Linux distributions using Postfix, Sendmail, Exim, and other mail transfer agents.

3. Detection and Assessment

You can confirm this vulnerability by checking the port your SMTP service is listening on. A quick check will show if it’s non-standard. Thorough assessment involves reviewing configuration files.

• Quick checks: Use netstat -tulnp | grep smtp (Linux) or Get-NetTCPConnection | Where-Object {$_.LocalPort -in (25,465,587)} (PowerShell). If the output doesn’t show listening on standard ports, investigate further.
• Scanning: Nessus plugin ID 30916 can detect non-standard SMTP ports. This is an example only; results should be verified.
• Logs and evidence: Check system logs for any unusual activity related to the SMTP service or connections on non-standard ports. Event IDs will vary by operating system.

netstat -tulnp | grep smtp

4. Solution / Remediation Steps

Fixing this issue involves checking and correcting your SMTP server configuration to use a standard port.

4.1 Preparation

• Dependencies: Ensure you have access to modify the SMTP service’s configuration files and restart the service. Roll back by restoring the original configuration file and restarting the service.
• Change window: A short change window is needed as the service will be briefly unavailable during a restart. Approval from the IT manager may be required.

4.2 Implementation

1. Step 1: Open the SMTP service’s configuration file (e.g., C:Program FilesMicrosoft Exchange ServerTransportRolesCommonDatatransportconfig.xml for Exchange).
2. Step 2: Locate the port setting and change it to either 25, 465 or 587.
3. Step 3: Save the configuration file.
4. Step 4: Restart the SMTP service. (e.g., Restart-Service MSExchangeTransport in PowerShell).

4.3 Config or Code Example

Before

<Port 12345>

After

<Port 25>

4.4 Security Practices Relevant to This Vulnerability

• Practice 1: Least privilege – limit access to the SMTP service configuration files to only authorised personnel, reducing the risk of malicious changes.
• Practice 2: Secure defaults – use standard ports and configurations whenever possible. Avoid custom settings unless absolutely necessary.

4.5 Automation (Optional)

No automation script is provided due to the potential for service disruption if incorrectly configured.

5. Verification / Validation

Confirm the fix by checking that your SMTP service now listens on a standard port and basic email functionality remains working.

• Post-fix check: Run netstat -tulnp | grep smtp (Linux) or Get-NetTCPConnection | Where-Object {$_.LocalPort -in (25,465,587)} (PowerShell). The output should show the service listening on port 25, 465, or 587.
• Re-test: Re-run the quick check from section 3 to confirm the non-standard port is no longer in use.
• Smoke test: Send a test email through your SMTP server and verify it’s delivered successfully. Check both sending and receiving functionality.

netstat -tulnp | grep smtp

6. Preventive Measures and Monitoring

• Baselines: Update your security baseline or policy to enforce standard port usage for all SMTP services. Consider a CIS control related to secure configuration.
• Asset and patch process: Review your SMTP server configurations regularly as part of your asset management process. A quarterly review is sensible.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 2: Incorrect configuration could prevent the SMTP service from starting. Ensure you have a backup of the original configuration file.
• Roll back: Restore the original SMTP service configuration file and restart the service.

8. References and Resources

• Vendor advisory or bulletin: http://www.icir.org/vern/papers/backdoor/
• NVD or CVE entry: Not applicable as this is a configuration issue, not a specific vulnerability with a CVE ID.
• Product or platform documentation relevant to the fix: Refer to your SMTP server’s official documentation for instructions on configuring port settings (e.g., Microsoft Exchange documentation).