[exim-dev] [Bug 3063] Partially vulnerable to "SMTP Smugglin…

Páxina inicial
Borrar esta mensaxe
Responder a esta mensaxe
Autor: Exim Bugzilla
Data:  
Para: exim-dev
Temas antigos: [exim-dev] [Bug 3063] New: Partially vulnerable to "SMTP Smuggling" if pipelining is enabled
Asunto: [exim-dev] [Bug 3063] Partially vulnerable to "SMTP Smuggling" if pipelining is enabled and chunking is disabled/unused
https://bugs.exim.org/show_bug.cgi?id=3063

Viktor Dukhovni <viktor1dane@???> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |viktor1dane@???


--- Comment #1 from Viktor Dukhovni <viktor1dane@???> ---
Does Exim enforce pipelining conformance by default?

That is, what is the default behaviour of Exim when an SMTP client expedites
some data before receiving a reply to a command (e.g. *DATA*) that should be
the *last* in a pipeline group?

Also, I should note that (as specified in RFC1830) BDAT is NOT the last command
in a pipeline group, and so Exim will accept two messages via a transaction of
the form:

MAIL FROM:<sender>
RCPT TO:<nobody>
DATA
From: Some Sender <sender>
To: Discarded Rcpt <nobody>
Subject: ...

<Some Message>
<LF>.<LF>
MAIL FROM:<forged-sender>
RCPT TO:<real-rcpt>
BDAT <length> LAST
From: Forged Sender <forged-sender>
To: Real Rcpt <real-rcpt>
Subject: Wire all your assets to me

<Phishing attack>
QUIT

It is sadly legal to pipeline any number of messages without any pauses with
BDAT. So provided the upstream system does not support CHUNKING, and treats
non-standard line endings (<LF>.<LF> or <LF>.<CR><LF>) as normal message
content to be sent verbatim, the SMTP smuggling scenario will work with that
system as the sending and Exim as the receiving MTA.

--
You are receiving this mail because:
You are on the CC list for the bug.

--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-dev.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-dev-unsubscribe@???
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/