[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240122142906.GA4821@openwall.com>
Date: Mon, 22 Jan 2024 15:29:06 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Wietse Venema <wietse@...cupine.org>
Subject: Postfix updated SMTP smuggling countermeasure
If I'm reading this right, the initial implementation of Postfix
smtpd_forbid_bare_newline disallowed bare LF not only at the end of
DATA, but also elsewhere in the SMTP session. This is now relaxed in
the recommended "smtpd_forbid_bare_newline = normalize" mode to apply
only to the end of DATA, while allowing bare LFs elsewhere. This is
sufficient to prevent the attack while having better compatibility with
existing SMTP clients.
----- Forwarded message from Wietse Venema via Postfix-announce <postfix-announce@...tfix.org> -----
To: Postfix announce <postfix-announce@...tfix.org>
Date: Mon, 22 Jan 2024 09:01:59 -0500 (EST)
Subject: [pfx-ann] Postfix stable release 3.8.5, 3.7.10, 3.6.14, 3.5.24
From: Wietse Venema via Postfix-announce <postfix-announce@...tfix.org>
Reply-To: Wietse Venema <wietse@...cupine.org>
[An on-line version of this announcement will be available at
https://www.postfix.org/announcements/postfix-3.8.5.html]
[Fixes for Postfix versions < 3.5 will be announced at
https://www.postfix.org/smtp-smuggling.html]
Postfix stable release 3.8.5, 3.7.10, 3.6.14, 3.5.24
Security: this release improves support to defend against an email
spoofing attack (SMTP smuggling) on recipients at a Postfix server. For
background, see https://www.postfix.org/smtp-smuggling.html.
The improvements provide better logging, and better compatibility with
existing SMTP clients (less need to allowlist clients).
Sites concerned about SMTP smuggling attacks should enable this feature
on Internet-facing Postfix servers. For compatibility with non-standard
clients, Postfix by default excludes clients in mynetworks from this
countermeasure.
The recommended settings are:
# Require the standard End-of-DATA sequence <CR><LF>.<CR><LF>.
# Otherwise, allow bare <LF> and process it as if the client sent
# <CR><LF>.
#
# This maintains compatibility with many legitimate SMTP client
# applications that send a mix of standard and non-standard line
# endings, but will fail to receive email from client implementations
# that do not terminate DATA content with the standard End-of-DATA
# sequence <CR><LF>.<CR><LF>.
#
# Such clients can be allowlisted with smtpd_forbid_bare_newline_exclusions.
# The example below allowlists SMTP clients in trusted networks.
#
smtpd_forbid_bare_newline = normalize
smtpd_forbid_bare_newline_exclusions = $mynetworks
Notes:
* The default setting is "smtpd_forbid_bare_newline = no" in Postfix
releases < 3.9, for compatibility reasons. This means that Postfix
is by default vulnerable to SMTP smuggling.
* The new setting "smtpd_forbid_bare_newline = normalize" is the
default for Postfix releases 3.9 and later.
* The old setting "smtpd_forbid_bare_newline = yes" is now an alias for
"smtpd_forbid_bare_newline = normalize".
* The new setting "smtpd_forbid_bare_newline = reject" will refuse
commands or message content with a bare newline. For details see
the RELEASE_NOTES or the postconf(5) documentation.
You can find the updated Postfix source code at the mirrors listed
at https://www.postfix.org/.
Wietse
_______________________________________________
Postfix-announce mailing list -- postfix-announce@...tfix.org
To unsubscribe send an email to postfix-announce-leave@...tfix.org
----- End forwarded message -----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
