Resolved Smtp Smuggling advisory

[theunknownstuntman]

Server operating system version

Ubuntu 20.04.6 LTS

Plesk version and microupdate number

18.0.54 Update #4

Regarding this advisory SMTP Smuggling - Spoofing E-Mails Worldwide

Is it safe to apply the following changes to postfix to a server managed by Plesk?

SMTP Smuggling

Thanks for your assistance.

 

[theunknownstuntman]

It is Plesk Obsidian 18.0.57 Update 4 actually.

 

[FrancoiseL]

I asked Plesk support this same question about our servers, here is their answer received today:

Thank you for waiting, we've got an update from Security Team.
Indeed, Plesk servers are affected by this vulnerability.
Plesk ships own Postfix 3.5.x packages for RHEL<=8 (and its forks) and Ubuntu 18. For other OSes Postfix is installed from OS vendor repositories.
The vulnerability fix for packages shipped by us is expected next week. Release for other operating systems depend on OS vendors. We are also considering to include necessary configuration changes for fixed versions.

Until security fix is released please consider applying short-term workaround suggested by Postfix SMTP Smuggling

1. Connect to the server via SSH.
2. Check Postfix version - first line of the output:
   # postconf -d | grep mail_version
3. Change the following directives by editing /etc/postfix/main.cf configuration file:
   • With all Postfix versions:
     smtpd_data_restrictions = reject_unauth_pipelining
     smtpd_discard_ehlo_keywords = chunking, silent-discard
   • Postfix 3.9, 3.8.1, 3.7.6, 3.6.10 and 3.5.20:
     smtpd_forbid_unauth_pipelining = yes
     smtpd_discard_ehlo_keywords = chunking, silent-discard

 

[theunknownstuntman]

I asked Plesk support this same question about our servers, here is their answer received today:

Thank you for waiting, we've got an update from Security Team.
Indeed, Plesk servers are affected by this vulnerability.
Plesk ships own Postfix 3.5.x packages for RHEL<=8 (and its forks) and Ubuntu 18. For other OSes Postfix is installed from OS vendor repositories.
The vulnerability fix for packages shipped by us is expected next week. Release for other operating systems depend on OS vendors. We are also considering to include necessary configuration changes for fixed versions.

Until security fix is released please consider applying short-term workaround suggested by Postfix SMTP Smuggling

1. Connect to the server via SSH.
2. Check Postfix version - first line of the output:
   # postconf -d | grep mail_version
3. Change the following directives by editing /etc/postfix/main.cf configuration file:
   • With all Postfix versions:
     smtpd_data_restrictions = reject_unauth_pipelining
     smtpd_discard_ehlo_keywords = chunking, silent-discard
   • Postfix 3.9, 3.8.1, 3.7.6, 3.6.10 and 3.5.20:
     smtpd_forbid_unauth_pipelining = yes
     smtpd_discard_ehlo_keywords = chunking, silent-discard

Thank you very much for answer.

Meanwhile I have applied the fix which is applicable for all Postfix versions. I am curious, when the postfix 3.5.x package is available. In Ubuntu 20.04.6 LTS only postfix 3.4.13 is included. The above mentioned fix is not fully adressing the vulnerability.

Workarounds:

"NOTE: this will block misuse of SMTP command pipelining.It will not block message pipelining (multiple MAIL transactionsper session), nor will it block a malformed end of line. Malformedline endings are addressed with the long-term solution."

 

[Peter Debik]

Please see

Resolved - Patch: Postfix - 37C3 - SMTP Smuggling – Spoofing E-Mails Worldwide

Username: TITLE Patch: Postfix - 37C3 - SMTP Smuggling – Spoofing E-Mails Worldwide PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE Debian 12, Postfix PROBLEM DESCRIPTION SMTP smuggling is a new attack technique SMTP smuggling is a new attack technique that allows attackers to...

talk.plesk.com

 

[theunknownstuntman]

For Ubuntu "focal" is "postfix (3.4.13-0ubuntu1.3)" available, which includes the final fix for CVE-2023-51764:

"smtpd_forbid_bare_newline = yes"

http://changelogs.ubuntu.com/changelogs/pool/main/p/postfix/postfix_3.4.13-0ubuntu1.3/changelog