← Back
Editing: cve-2023-51766.txt
CVE ID: CVE-2023-51766 Date: 2016-12-15 Credits: https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/ Version(s): all up to 4.97 inclusive Issue: Given a buggy relay, Exim can be induced to accept a second message embedded as part of the body of a first message Conditions ========== If *all* the following conditions are met Runtime options --------------- * Exim offers PIPELINING on incoming connections * Exim offers CHUNKING on incoming connections Operation --------- * DATA (as opposed to BDAT) is used for a message reception * The relay host sends to the Exim MTA message data including one of "LF . LF" or "CR LF . LF" or "LF . CR LF". * Exim interprets the sequence as signalling the end of data for the SMTP DATA command, and hence a first message. * Exim interprets further input which the relay had as message body data, as SMTP commands and data. This could include a MAIL, RCPT, BDAT (etc) sequence, resulting in a further message acceptance. Impact ====== One or more messages can be accepted by Exim that have not been properly validated by the buggy relay. Fix === Install a fixed Exim version: 4.98 (once available) 4.97.1 If you can't install one of the above versions, ask your package maintainer for a version containing the backported fix. On request and depending on our resources we will support you in backporting the fix. (Please note, that Exim project officially doesn't support versions prior the current stable version.) Workaround ========== Disable CHUNKING advertisement for incoming connections. An attempt to "smuggle" a DATA command will trip a syncronisation check. *or* Disable PIPELINING advertisement for incoming connections. The "smuggled" MAIL FROM command will then trip a syncronisation check.
Save File
Cancel