Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 23 Dec 2023 01:33:13 +0200 (EET)
From: Harry Sintonen <>
Subject: Re: Re: New SMTP smuggling attack

On Fri, 22 Dec 2023, Stuart D Gathman wrote:

> On Sat, 23 Dec 2023, Alexander E. Patrakov wrote:
>>> I'm trying to make sense of it - where's the compromise of the
>>> Confidentiality, Integrity or Availability of the affected mail
>>> servers?
>> The integrity of the sender's identity, as a minimum, is compromised
>> here. Normally, when relaying mail, servers add a "Received:" header
>> that specifies where they received the connection from. This allows
>> tracking down the true origin of the message. The smuggled message
>> does not have such a header and thus misrepresents the vulnerable
>> relay as the ultimate sender. Additionally, if the relay has
>> destination-based deny lists that deny some but not all addresses on
>> the destination domain, they are sidestepped.
> This is certainly a bug, but the currently reality is that
> authentication involves SPF, DKIM, and other schemes - and does not
> solely rely on headers.  So can this "delete some headers" attack
> compromise these authentication schemes?

This is the key here: These validation schemes will act on other data 
(which the attacker provides, and is valid). Hence the email passes these 
validations and continues in the delivery chain.

Now comes the actual smuggling bug: Since the parsing of <CR><LF> is 
buggy, a forged message (will different details) will actually get 

This is all described in detail in the excellent SEC Consult advisory.

l=2001;main(i){float o,O,_,I,D;for(;O=I=l/571.-1.75,l;)for(putchar(--l%80?
("  Harry 'Piru' Sintonen <>");}

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.