[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <d23e7dd0-eb16-046d-b418-ef130a2ccd4f@iki.fi>
Date: Sat, 23 Dec 2023 01:33:13 +0200 (EET)
From: Harry Sintonen <sintonen@....fi>
To: oss-security@...ts.openwall.com
Subject: Re: Re: New SMTP smuggling attack
On Fri, 22 Dec 2023, Stuart D Gathman wrote:
> On Sat, 23 Dec 2023, Alexander E. Patrakov wrote:
>
>>> I'm trying to make sense of it - where's the compromise of the
>>> Confidentiality, Integrity or Availability of the affected mail
>>> servers?
>>>
>>
>> The integrity of the sender's identity, as a minimum, is compromised
>> here. Normally, when relaying mail, servers add a "Received:" header
>> that specifies where they received the connection from. This allows
>> tracking down the true origin of the message. The smuggled message
>> does not have such a header and thus misrepresents the vulnerable
>> relay as the ultimate sender. Additionally, if the relay has
>> destination-based deny lists that deny some but not all addresses on
>> the destination domain, they are sidestepped.
>
> This is certainly a bug, but the currently reality is that
> authentication involves SPF, DKIM, and other schemes - and does not
> solely rely on headers. So can this "delete some headers" attack
> compromise these authentication schemes?
This is the key here: These validation schemes will act on other data
(which the attacker provides, and is valid). Hence the email passes these
validations and continues in the delivery chain.
Now comes the actual smuggling bug: Since the parsing of <CR><LF> is
buggy, a forged message (will different details) will actually get
delivered.
This is all described in detail in the excellent SEC Consult advisory.
Regards,
--
l=2001;main(i){float o,O,_,I,D;for(;O=I=l/571.-1.75,l;)for(putchar(--l%80?
i:10),o=D=l%80*.05-2,i=31;_=O*O,O=2*o*O+I,o=o*o-_+D,o+_+_<4+D&i++<87;);puts
(" Harry 'Piru' Sintonen <sintonen@....fi> https://www.iki.fi/sintonen");}
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
