https://seclists.org/oss-sec/2023/q4/307: New SMTP smuggling attack
Published Dec 21, 2023
·Updated
Affected Software
1 affected component
Sendmail Sendmail
Frequently Asked Questions
1
What is the severity of the New SMTP smuggling attack?
The severity of the New SMTP smuggling attack is considered high due to potential exploitation risks in email handling.
2
How do I fix the New SMTP smuggling attack?
To mitigate the New SMTP smuggling attack, configure Sendmail to use the srv_features option 'o' and ensure it only accepts CR LF sequence as per RFCs.
3
What versions of Sendmail are affected by the New SMTP smuggling attack?
The New SMTP smuggling attack affects Sendmail version 8.18.0.2 and potentially earlier versions.
4
Can the New SMTP smuggling attack lead to data loss?
Yes, the New SMTP smuggling attack can lead to unauthorized access or data loss through email injection vulnerabilities.
5
Is there a workaround for the New SMTP smuggling attack?
A temporary workaround for the New SMTP smuggling attack includes restricting the input to CR LF sequence by adjusting Sendmail's configuration settings.