Internal host disclosure via SMTP timing scans

CWE-385 in Red Hat Single Sign-On 7.x allows remote authenticated users to infer internal host and port state via SMTP timing scans. The administration console Test Connection feature sends SMTP connection attempts to attacker-selected hosts and ports, and response-time differences reveal whether those destinations are reachable from the RH-SSO server. The attack requires an authorized console account and primarily discloses network topology and service availability rather than changing data or interrupting the server.