cbcvebase.
CVE-2007-0213
published 2007-05-08

CVE-2007-0213: Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute…

PriorityP267critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
66.16%
99.2th percentile
Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message.

Affected

3 ranges
VendorProductVersion rangeFixed in
microsoftexchange_server——
microsoftexchange_server——
microsoftexchange_server——

Detection & IOCsextracted from sources · hover to see the quote

othereJ8+InlpAQaQCAAEAAAAAAABAAEAAgKQBgAOAAAAAAAAAAAAAAAAAAAAAAAAAAIFkAYAevwAAAEAAAANAAE3AQAAAGr8AAALAAAAAAAAAMAAAAAAAABG0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAAEAAA/v///wAAAAD+////AAAAAAAAAAD↗
  • →Exploit targets Microsoft Exchange 2003 SP0 via a crafted base64-encoded MIME e-mail message causing memory corruption; detect anomalous or oversized base64-encoded MIME payloads in inbound SMTP traffic to Exchange servers. ↗
  • →The exploit is delivered over SMTP (socket-based); monitor for SMTP sessions delivering extremely large base64-encoded MIME body parts to Exchange 2000/2003/2007 servers. ↗
  • →The NSA ENGLISHMANSDENTIST exploit payload begins with the distinctive base64 prefix 'eJ8+InlpAQaQ'; signature-match this string in MIME body content on Exchange SMTP listeners. ↗
  • →Exploit targets Windows Server 2003 R2 running Exchange 2003; prioritize detection on this platform combination. ↗
  • ·The exploit script is written for Python 2.7 (as bundled with ImmunityDBG) and targets Exchange 2003 SP0 specifically; the CVE also affects Exchange 2000 SP3, 2003 SP1/SP2, and 2007, so detection should cover all affected versions. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.