XCCC: POP3 Clients Can Use Any Password to Access their Mailbox (813259)

The information in this article applies to:

Microsoft Exchange 2000 Enterprise Server
Microsoft Exchange 2000 Server

SYMPTOMS

When you type an incorrect password for your Post Office Protocol version 3 (POP3) e-mail account, you can still log on to your mailbox to send and receive e-mail messages.

CAUSE

This issue may occur in both the following scenarios:

The Microsoft Exchange 2000 Server that hosts your mailbox is installed on a Microsoft Windows 2000 Server Service Pack 2 (SP2)-based computer.
Your user account is configured to use a blank password.

This issue occurs because the Internet Message Access Protocol (IMAP) implementation in Windows 2000 Server SP2 requires an argument when using the PASS command. When you configure an account with a blank password, any password that is entered is interpreted as a valid password for the PASS command.

RESOLUTION

To resolve this issue, upgrade the Windows 2000 Server-based computer on which Exchange 2000 Server is installed, to Windows 2000 Service Pack 3 (SP3).

After you install Windows 2000 SP3 on the Windows 2000 Server-based computer, the user receives a password prompt when typing an incorrect password for a mailbox account that is configured with a blank password. To obtain SP3 for Windows 2000, visit the following Microsoft Web site:

http://www.microsoft.com/windows2000/downloads/servicepacks/sp3/sp3lang.asp

WORKAROUND

To work around this issue, assign a non-blank password to the user account.

Modification Type:	Minor	Last Reviewed:	10/26/2005
Keywords:	kbBug kbprb KB813259