[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231229130718.GA6740@openwall.com>
Date: Fri, 29 Dec 2023 14:07:18 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-51766: Exim: SMTP smuggling
Hi,
Exim was also susceptible to SMTP smuggling, and version 4.97.1 is now
released to address this. Included below is doc/doc-txt/cve-2023-51766
from the exim-4.97.1 branch (with erroneous Date: line omitted).
Alexander
---
CVE ID: CVE-2023-51766
Credits: https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
Version(s): all up to 4.97 inclusive
Issue: Given a buggy relay, Exim can be induced to accept a second message embedded
as part of the body of a first message
Conditions
==========
If *all* the following conditions are met
Runtime options
---------------
* Exim offers PIPELINING on incoming connections
* Exim offers CHUNKING on incoming connections
Operation
---------
* DATA (as opposed to BDAT) is used for a message reception
* The relay host sends to the Exim MTA message data including
one of "LF . LF" or "CR LF . LF" or "LF . CR LF".
* Exim interprets the sequence as signalling the end of data for
the SMTP DATA command, and hence a first message.
* Exim interprets further input which the relay had as message body
data, as SMTP commands and data. This could include a MAIL, RCPT,
BDAT (etc) sequence, resulting in a further message acceptance.
Impact
======
One or more messages can be accepted by Exim that have not been
properly validated by the buggy relay.
Fix
===
Install a fixed Exim version:
4.98 (once available)
4.97.1
If you can't install one of the above versions, ask your package
maintainer for a version containing the backported fix. On request and
depending on our resources we will support you in backporting the fix.
(Please note, that Exim project officially doesn't support versions
prior the current stable version.)
Workaround
==========
Disable CHUNKING advertisement for incoming connections.
An attempt to "smuggle" a DATA command will trip a syncronisation
check.
*or*
Disable PIPELINING advertisement for incoming connections.
The "smuggled" MAIL FROM command will then trip a syncronisation
check.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
