CVE-2003-0714

Exchange Server 5.5 and 2000 - Denial of Service via SMTP Extended Verb Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2003-0714. PoCs published by Metasploit, H D Moore, hdm, aushack, including Metasploit module exploits/windows/smtp/ms03_046_exchange2000_xexch50.

AI-analyzed exploit summary This is a Metasploit module exploiting a heap overflow in Microsoft Exchange 2000 via the XEXCH50 command. It attempts to achieve remote code execution by overwriting heap memory with a crafted payload.

Description

The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 allows remote attackers to cause a denial of service (memory exhaustion) by directly connecting to the SMTP service and sending a certain extended verb request, possibly triggering a buffer overflow in Exchange 2000.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/16820

This is a Metasploit module exploiting a heap overflow in Microsoft Exchange 2000 via the XEXCH50 command. It attempts to achieve remote code execution by overwriting heap memory with a crafted payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Racy
Target: Microsoft Exchange 2000 (SP0, SP3)
No auth needed
Prerequisites: Network access to TCP port 25 (SMTP) · Vulnerable Exchange 2000 server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by H D Moore · perldoswindows
https://www.exploit-db.com/exploits/113

This Perl script exploits CVE-2003-0714, a heap overflow vulnerability in Microsoft Exchange Server's SMTP service. It includes both a check mode to verify vulnerability and a crash mode to trigger a denial-of-service (DoS) by sending a malformed XEXCH50 command with a negative size value.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Moderate
Reliability
Racy
Target: Microsoft Exchange Server (pre-MS03-046 patch)
No auth needed
Prerequisites: Network access to the SMTP service (port 25) · Unpatched Microsoft Exchange Server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC GOOD
by hdm, aushack · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smtp/ms03_046_exchange2000_xexch50.rb

This is a Metasploit module exploiting a heap overflow vulnerability in Microsoft Exchange 2000 via the XEXCH50 command. It attempts to achieve remote code execution by overwriting heap memory with a crafted payload, though it is noted to be highly unreliable.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Complex
Reliability
Racy
Target: Microsoft Exchange 2000 SP0 and SP3
No auth needed
Prerequisites: Network access to the SMTP port (25) of the target Exchange server · Target server must be unpatched for MS03-046
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.cert.org/advisories/CA-2003-27.html
Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=106682909006586&w=2
Patch, Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/422156
Patch, Vendor Advisory vendor-advisory x_refsource_ms
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-046
Exploit, Patch, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/8838

Scores

EPSS 0.7639
EPSS Percentile 99.5%

Details

CWE
CWE-400
Status published
Products (2)
microsoft/exchange_server 5.5 (5 CPE variants)
microsoft/exchange_server 2000 (4 CPE variants)
Published Nov 17, 2003
Tracked Since Feb 18, 2026