Title

Sending or Receiving message size is not set to Unlimited on the SMTP virtual server. (Cat III impact)

Discussion

E-mail system availability depends in part on best practices strategies for setting tuning configurations. E-mail system availability has become a necessary feature in information sharing, and controlling message size limit reduces risk that servers become unavailable due to message size conflicts. By setting “unlimited” at the virtual server level, it enables the global setting to prevail without being overridden at this level. The message size limit applies to E-mail and other features that use Simple Message Transfer Protocol (SMTP), such as Public Folders. The default setting of ‘no limit’ at the virtual server level is recommended and should provide sufficient protection against excessively large messages passing through the virtual server. Message size limits may be applied in Virtual Servers, Routing Group connectors, SMTP connectors, Public Folders, and on the user account under Active Directory. Changes at these lower levels are discouraged, as the single global setting is usually sufficient. This practice prevents conflicts that could impact availability and it simplifies server administration.

Check Content

Review Message Size setting for each SMTP virtual server. Procedure: Exchange System Manager >> Administrative Groups >> [administrator group] >> Servers >> [server] >> Protocols >> SMTP >> [specific SMTP server] >> Properties >>Messages tab Note: If “administrative groups” do not display in the list, highlight the topmost “Exchange” item in the left hand list, then access the Action menu, select Properties, check the “Display Routing Groups” box, and the “display administrative groups” box. Exit Exchange Manager, then restart it, and repeat the “check” steps. The checkbox for “Limit Message size to (KB)” should be cleared. Criteria: If the “Limit Message Size to (KB)" is cleared, this is not a finding.

Fix Text

Set the sending and receiving message size for the SMTP virtual server to unlimited. Procedure: Exchange System Manager >> Administrative Groups >> [administrator group] >> Servers >> [server] >> Protocols >> SMTP >> [specific SMTP server] >> Properties >>Messages tab Clear the checkbox for “Limit Message size to (KB)”

Additional Identifiers

Rule ID: SV-20278r1_rule

Vulnerability ID: V-18667

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.