oss-sec mailing list archives
Re: New SMTP smuggling attack
From: nightmare.yeah27 () aceecat org
Date: Tue, 30 Apr 2024 12:13:11 -0700
On Mon, Apr 29, 2024 at 08:19:52PM GMT, Mark Esler wrote:
To mitigate future end-of-data sequence attacks, like SMTP Smuggling, MTAs should comply with RFC 5321 section 4.1.1.4 [0] to strip control characters other than <SP>, <HT>, <CR>, and <LF> in the DATA section of SMTP messages.
[...]
As per RFC 2119 section 3 [2], the word *SHOULD* implies *MUST* unless you have a valid reason not to--which is never the case for these _forbidden_ sequences in DATA. This is why RFC 5321 4.1.1.4's _SHOULD avoid_ implies _needs to strip_.
I don't see that stripping specifically is implied.
What are the benefits and risks of stripping ASCII NUL and other control characters from SMTP DATA?
What is the benefit of stripping versus the much more natural option of rejecting such messages? One possible consequence of passing messages along in an altered form is that various signatures may break. -- Ian
Current thread:
- Re: New SMTP smuggling attack Mark Esler (Apr 30)
- Re: New SMTP smuggling attack nightmare . yeah27 (Apr 30)
- Re: New SMTP smuggling attack Erik Auerswald (Apr 30)
- Re: New SMTP smuggling attack Steffen Nurpmeso (Apr 30)
- Re: New SMTP smuggling attack Steffen Nurpmeso (May 02)
- Re: New SMTP smuggling attack Solar Designer (May 02)
- Re: New SMTP smuggling attack Mark Esler (May 09)
- Re: New SMTP smuggling attack Erik Auerswald (May 09)
- Re: New SMTP smuggling attack Steffen Nurpmeso (May 02)