Mail Management Server Service User Enumeration

The MailMa service that runs on port 106 is potentially open to a User Enumeration disclosure.

When issuing the command User and the user name supplied does not exist MAILMA returns this :-

510 "Error 2 in OpenMailbox, The system cannot find the file specified."

When the user exists MAILMA responds with this response :-

200 Ok, "send password"

To stop a potential User Enumeration Attack on this Service the port 106 should be blocked at the firewall so that access is not possible from the Internet.

The current status of this issue is that we are not going to be resolving this as in a future release we will be retiring this service from the product and with the workaround detailed here there is no impact.