sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
escription: By exploiting interpretation differences of the SMTP protocol, it is possible to smuggle/send spoofed e-mails - hence SMTP smuggling - while still passing SPF alignment checks. During this research, two types of SMTP smuggling, outbound and inbound, were discovered. These allowed sending spoofed e-mails from millions of domains (e.g., admin[@]outlook.com) to millions of receiving SMTP servers (e.g., Amazon, PayPal, eBay). Identified vulnerabilities in Microsoft and GMX were quickly fixed, however, SEC Consult urges companies using the also affected Cisco Secure Email product to manually update their vulnerable default configuration.
References: https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
On Fri, Dec 29, 2023, Alan Coopersmith wrote: - CVE-2023-51765 sendmail
so you can submit updates/corrections via the web form at: https://cveform.mitre.org/ Thanks for the URL, I've submitted my changes yesterday.
On Fri, Dec 29, 2023 at 12:50:55PM -0800, Alan Coopersmith wrote: On 12/26/23 11:15, Claus Assmann wrote: On Sun, Dec 24, 2023, Marcus Meissner wrote: - CVE-2023-51765 sendmail Can you update the text for this (or point me to the proper way/persons to do this)? https://www.cve.org/CVERecord?id=CVE-2023-51765 shows: Assigner: MITRE Corporation
so you can submit updates/corrections via the web form at: https://cveform.mitre.org/ Yes please use this form, or if you do not want one of us can do it.
I did not request the sendmail and exim CVEs, also the postfix CVE seems not my proposed description, so I guess someone else requested them.
Ciao, Marcus
On 12/26/23 11:15, Claus Assmann wrote: On Sun, Dec 24, 2023, Marcus Meissner wrote: - CVE-2023-51765 sendmail Can you update the text for this (or point me to the proper way/persons to do this)? https://www.cve.org/CVERecord?id=CVE-2023-51765 shows: Assigner: MITRE Corporation
so you can submit updates/corrections via the web form at: https://cveform.mitre.org/
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
On Sun, Dec 24, 2023, Marcus Meissner wrote: - CVE-2023-51765 sendmail Can you update the text for this (or point me to the proper way/persons to do this)?
1. "sendmail through at least 8.14.7" -> sendmail up to and including 8.17.2
2. remove the seemingly unrelated reference to "Merge sendmail 8.14.8 to HEAD freebsd/freebsd-src@5dd76dd"
3. Mention that 8.18 fixes the problem: Accept only CR LF . CR LF as end of an SMTP message as required by the RFCs when the new srvfeatures option 'o' is used.
sendmail 8.18.0.2 is available at https://ftp.sendmail.org/snapshots/sendmail.8.18.0.2.tar.gz https://ftp.sendmail.org/snapshots/sendmail.8.18.0.2.tar.gz.sig
Happy christmas list! On 24/12/2023 12.33, Marcus Meissner wrote: On Sat, Dec 23, 2023 at 02:29:34PM +0200, Valtteri Vuorikoski wrote: On Fri, Dec 22, 2023 at 11:46:48AM +0100, Marcus Meissner wrote: Hi,
FWIW as no CVEs were to be found yet, I filed a CVE request for Postfix now.
Not sure if we need it for others like sendmail too, as that is also referenced by the security researchers. Looks like exim opened a bug on this yesterday too, no sign of CVE yet: <https://bugs.exim.org/showbug.cgi?id=3063> CVEs are assigned now for:
- CVE-2023-51764 postfix - CVE-2023-51765 sendmail - CVE-2023-51766 exim
Ciao, Marcus
On Sat, Dec 23, 2023 at 02:29:34PM +0200, Valtteri Vuorikoski wrote: On Fri, Dec 22, 2023 at 11:46:48AM +0100, Marcus Meissner wrote: Hi,
FWIW as no CVEs were to be found yet, I filed a CVE request for Postfix now.
Not sure if we need it for others like sendmail too, as that is also referenced by the security researchers. Looks like exim opened a bug on this yesterday too, no sign of CVE yet: <https://bugs.exim.org/showbug.cgi?id=3063> CVEs are assigned now for:
- CVE-2023-51764 postfix - CVE-2023-51765 sendmail - CVE-2023-51766 exim
Ciao, Marcus
On 2023/12/22 11:46, Marcus Meissner wrote: Hi,
FWIW as no CVEs were to be found yet, I filed a CVE request for Postfix now.
Not sure if we need it for others like sendmail too, as that is also referenced by the security researchers. I'm a little confused by sec-consult's process here. They identify a problem affecting various pieces of software including some very widely deployed open source software, go to the trouble of doing a coordinated disclosure, but only do that with...looking at their timeline... gmx, microsoft and cisco?
Hi,
FWIW as no CVEs were to be found yet, I filed a CVE request for Postfix now.
Not sure if we need it for others like sendmail too, as that is also referenced by the security researchers.
Ciao, Marcus On Thu, Dec 21, 2023 at 02:46:56PM +0000, Claus Assmann wrote: Just for completeness: sendmail 8.18.0.2 has options to handle this too, e.g., Accept only CR LF . CR LF as end of an SMTP message as required by the RFCs when the new srvfeatures option 'o' is used.
And for those who read the source code there's also an FFR: / enable checking for "bare LF" in message / "FFRBARELF",
Just for completeness: sendmail 8.18.0.2 has options to handle this too, e.g., Accept only CR LF . CR LF as end of an SMTP message as required by the RFCs when the new srvfeatures option 'o' is used.
And for those who read the source code there's also an FFR: / enable checking for "bare LF" in message / "FFRBARELF",