Brand ClaimErleben, was verbindet

Information on the use of cookies

This website uses only the technically necessary cookies to provide you with the best possible service.
Your session is identified by a so-called session cookie in order to maintain your language choice and to allow a comfortable form use. Furthermore, a login is only possible by using a cookie.
Further information can be found in the data protection information.

Accept

Advisory 2023-2741 - SMTP implementations: Vulnerability allows bypassing security measures

Notice: You can now also find information from the Vulnerability Advisory Service in the CTI portal!
The CTI portal is available at the following address: https://cti-portal.telekom.net/advisories/2023-2741
Notice: This advisory is by exception shown completely public. You will regularly receive details on vulnerability information as a customer via your login or through our daily advisory e-mail.
5
Attack probability
high
3
Potential damage
medium
remote anonymous attackerExploit available
Date
2023-12-22
Release
2024-11-12 UPDATE

Operating System

  • Linux
  • UNIX

Software

  • Open Source Postfix < 3.9
  • Open Source sendmail
  • UPDATE 2023-12-27
  • Open Source Exim
  • UPDATE 2023-12-28
  • SUSE Linux
  • UPDATE 2024-01-03
  • Fedora Linux
  • UPDATE 2024-01-05
  • Debian Linux
  • UPDATE 2024-01-23
  • Amazon Linux 2
  • Ubuntu Linux
  • UPDATE 2024-04-12
  • IBM AIX 7.2
  • IBM AIX 7.3
  • IBM VIOS 3.1
  • IBM VIOS 4.1
  • UPDATE 2024-08-06
  • Dell NetWorker
  • EMC Avamar
  • UPDATE 2024-11-12
  • Red Hat Enterprise Linux

Attack

A remote anonymous attacker can exploit a vulnerability in various SMTP implementations in order to bypass security measures.

Description

Postfix is an open source email server for Linux and unix-like operationsystems. Sendmail is a mail transfer agent for UNIX operating systems. Exim (EXperimental Internet Mailer) is a mail server and mail transfer agent.

CVE-2023-51764, CVE-2023-51765, CVE-2023-51766

A vulnerability exists in various SMTP implementations. Depending on how SMTP servers/software are configured to interpret the end-of-data sequence (e.g. CR+LF.CR+LF), an attacker can break out of the message data and "inject" SMTP commands to send spoofed emails that bypass SPF checks. A remote, anonymous attacker can exploit this vulnerability to bypass security measures.

CVSSv2 Base Score: 6.8 / Temporal Score: 5.3
AV:N/AC:M/AU:N/C:P/I:P/A:P/E:POC/RL:OF/RC:ND
CVSSv3.1 Base Score: 8.3 / Temporal Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:X

PoC code taking advantage of the vulnerability is available on the Internet.

Recommendation

The postfix developers provide updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.mail-archive.com/postfix-users@postfix.org/msg100901.html

UPDATE 2023-12-27

There is currently no update or patch available to fix this vulnerability.
https://bugzilla.redhat.com/show_bug.cgi?id=2255852
https://bugzilla.redhat.com/show_bug.cgi?id=2255869

UPDATE 2023-12-28

SUSE provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.suse.com/pipermail/sle-security-updates/2023-December/017566.html

UPDATE 2024-01-03

Fedora provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-c839e7294f
https://bodhi.fedoraproject.org/updates/FEDORA-2024-5c186175f2

SUSE provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.suse.com/pipermail/sle-security-updates/2024-January/017584.html

UPDATE 2024-01-04

Fedora provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-8eb8988cb8
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-9bc09085c7
https://bodhi.fedoraproject.org/updates/FEDORA-2024-1ef6197a49
https://bodhi.fedoraproject.org/updates/FEDORA-2024-e0841c83bb
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-54a5c04d0c

UPDATE 2024-01-05

Debian provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.debian.org/debian-security-announce/2024/msg00004.html

UPDATE 2024-01-08
https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html

UPDATE 2024-01-23

Amazon provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://alas.aws.amazon.com/ALAS-2024-1908.html
https://alas.aws.amazon.com/AL2/ALAS-2024-2420.html

Ubuntu provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://ubuntu.com/security/notices/USN-6591-1

Postfix provides further information
https://www.postfix.org/smtp-smuggling.html

UPDATE 2024-01-29

Ubuntu provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://ubuntu.com/security/notices/USN-6611-1

UPDATE 2024-01-31

Debian provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html

UPDATE 2024-02-01

Ubuntu provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://ubuntu.com/security/notices/USN-6591-2

UPDATE 2024-02-06

Amazon provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://alas.aws.amazon.com/ALAS-2024-1914.html

UPDATE 2024-03-04

SUSE provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.suse.com/pipermail/sle-security-updates/2024-March/018086.html
https://lists.suse.com/pipermail/sle-security-updates/2024-March/018087.html

UPDATE 2024-04-09
https://lists.suse.com/pipermail/sle-security-updates/2024-April/018274.html

UPDATE 2024-04-12

IBM provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://aix.software.ibm.com/aix/efixes/security/sendmail_advisory4.asc

UPDATE 2024-06-17

Debian provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://lists.debian.org/debian-lts-announce/2024/06/msg00004.html

UPDATE 2024-08-06

Dell provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://www.dell.com/support/kbdoc/de-de/000227573/dsa-2024-348-security-update-for-dell-avamar-dell-networker-virtual-edition-nve-and-dell-powerprotect-dp-series-appliance-dell-integrated-data-protection-appliance-idpa-security-update-for-multiple-vulnerabilities

UPDATE 2024-11-12

Red Hat provides updates. Please update your installation and see the vendor's advisory to find the proper version suitable for your environment.
https://access.redhat.com/errata/RHSA-2024:9243

Information

Red Hat Bugzilla dated 2023-12-21
https://bugzilla.redhat.com/show_bug.cgi?id=2255563

SECConsult Blog dated 2023-12-21
https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/

Postfix Patch dated 2023-12-21
https://www.mail-archive.com/postfix-users@postfix.org/msg100901.html

UPDATE 2023-12-27

Github Advisory Database dated 2023-12-21
https://github.com/advisories/GHSA-j5jm-hg4x-w8rx

Red Hat Bugzilla dated 2023-12-27
https://bugzilla.redhat.com/show_bug.cgi?id=2255852

Red Hat Bugzilla dated 2023-12-27
https://bugzilla.redhat.com/show_bug.cgi?id=2255869

UPDATE 2023-12-28

SUSE Security Update SUSE-SU-2023:4981-1 dated 2023-12-28
https://lists.suse.com/pipermail/sle-security-updates/2023-December/017566.html

UPDATE 2024-01-03

Fedora Security Advisory FEDORA-2024-C839E7294F dated 2024-01-03
https://bodhi.fedoraproject.org/updates/FEDORA-2024-c839e7294f

Fedora Security Advisory FEDORA-2024-5C186175F2 dated 2024-01-03
https://bodhi.fedoraproject.org/updates/FEDORA-2024-5c186175f2

SUSE Security Update SUSE-SU-2024:0012-1 dated 2024-01-02
https://lists.suse.com/pipermail/sle-security-updates/2024-January/017584.html

UPDATE 2024-01-04

Fedora Security Advisory FEDORA-EPEL-2024-8EB8988CB8 dated 2024-01-03
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-8eb8988cb8

Fedora Security Advisory FEDORA-EPEL-2024-9BC09085C7 dated 2024-01-03
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-9bc09085c7

Fedora Security Advisory FEDORA-2024-1EF6197A49 dated 2024-01-03
https://bodhi.fedoraproject.org/updates/FEDORA-2024-1ef6197a49

Fedora Security Advisory FEDORA-2024-E0841C83BB dated 2024-01-03
https://bodhi.fedoraproject.org/updates/FEDORA-2024-e0841c83bb

Fedora Security Advisory FEDORA-EPEL-2024-54A5C04D0C dated 2024-01-03
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-54a5c04d0c

UPDATE 2024-01-05

Debian Security Advisory DSA-5597 dated 2024-01-04
https://lists.debian.org/debian-security-announce/2024/msg00004.html

UPDATE 2024-01-08

Debian Security Advisory DLA-3708 dated 2024-01-05
https://lists.debian.org/debian-lts-announce/2024/01/msg00002.html

UPDATE 2024-01-23

Amazon Linux Security Advisory ALAS-2024-1908 dated 2024-01-23
https://alas.aws.amazon.com/ALAS-2024-1908.html

Amazon Linux Security Advisory ALAS-2024-2420 dated 2024-01-23
https://alas.aws.amazon.com/AL2/ALAS-2024-2420.html

Ubuntu Security Notice USN-6591-1 dated 2024-01-22
https://ubuntu.com/security/notices/USN-6591-1

Postfix Advisory dated 2024-01-22
https://www.postfix.org/smtp-smuggling.html

UPDATE 2024-01-29

Ubuntu Security Notice USN-6611-1 dated 2024-01-29
https://ubuntu.com/security/notices/USN-6611-1

UPDATE 2024-01-31

Debian Security Advisory DLA-3725 dated 2024-01-30
https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html

UPDATE 2024-02-01

Ubuntu Security Notice USN-6591-2 dated 2024-01-31
https://ubuntu.com/security/notices/USN-6591-2

UPDATE 2024-02-06

Amazon Linux Security Advisory ALAS-2024-1914 dated 2024-02-06
https://alas.aws.amazon.com/ALAS-2024-1914.html

UPDATE 2024-03-04

SUSE Security Update SUSE-SU-2024:0743-1 dated 2024-03-04
https://lists.suse.com/pipermail/sle-security-updates/2024-March/018086.html

SUSE Security Update SUSE-SU-2024:0742-1 dated 2024-03-04
https://lists.suse.com/pipermail/sle-security-updates/2024-March/018087.html

UPDATE 2024-04-09

SUSE Security Update SUSE-SU-2024:1149-1 dated 2024-04-08
https://lists.suse.com/pipermail/sle-security-updates/2024-April/018274.html

UPDATE 2024-04-12

IBM Security Bulletin 7148150 dated 2024-04-11
https://aix.software.ibm.com/aix/efixes/security/sendmail_advisory4.asc

UPDATE 2024-06-17

Debian Security Advisory DLA-3829 dated 2024-06-15
https://lists.debian.org/debian-lts-announce/2024/06/msg00004.html

UPDATE 2024-08-06

Dell Security Advisory DSA-2024-348 dated 2024-08-06
https://www.dell.com/support/kbdoc/de-de/000227573/dsa-2024-348-security-update-for-dell-avamar-dell-networker-virtual-edition-nve-and-dell-powerprotect-dp-series-appliance-dell-integrated-data-protection-appliance-idpa-security-update-for-multiple-vulnerabilities

UPDATE 2024-11-12

Red Hat Security Advisory RHSA-2024:9243 dated 2024-11-12
https://access.redhat.com/errata/RHSA-2024:9243

References

AMAZONLINUX:ALAS-2024-1908
AMAZONLINUX:ALAS-2024-1914
AMAZONLINUX:ALAS-2024-2420
CVE:CVE-2023-51764
CVE:CVE-2023-51765
CVE:CVE-2023-51766
DEBIAN:DLA-3708
DEBIAN:DLA-3725
DEBIAN:DLA-3829
DEBIAN:DSA-5597
DELL:DSA-2024-348
FEDORA:FEDORA-2024-1EF6197A49
FEDORA:FEDORA-2024-5C186175F2
FEDORA:FEDORA-2024-C839E7294F
FEDORA:FEDORA-2024-E0841C83BB
FEDORA:FEDORA-EPEL-2024-54A5C04D0C
FEDORA:FEDORA-EPEL-2024-8EB8988CB8
FEDORA:FEDORA-EPEL-2024-9BC09085C7
GITHUB:GHSA-5RCQ-25VC-G8QR
GITHUB:GHSA-J5JM-HG4X-W8RX
GITHUB:GHSA-W6WW-869J-CGM6
IBM:7148150
REDHAT:RHSA-2024:9243
REDHAT-BUG:2255563
REDHAT-BUG:2255852
REDHAT-BUG:2255869
SUSE:SUSE-SU-2023:4981-1
SUSE:SUSE-SU-2024:0012-1
SUSE:SUSE-SU-2024:0742-1
SUSE:SUSE-SU-2024:0743-1
SUSE:SUSE-SU-2024:1149-1
UBUNTU:USN-6591-1
UBUNTU:USN-6591-2
UBUNTU:USN-6611-1

Disclaimer

*The probability of an attack is determined by the attacker's motivation, the necessary expend and the possibilities for an attack. The damage probability is determined by the expend needed to resolute the attack and probable indirect consequences of an attack for business processes. Telekom Security assumes worst case scenarios.

Copyright © 1999-2026 Deutsche Telekom Security GmbH. All rights reserved. Reproduction and distribution of this publication in any form - even in parts - without prior written permission is forbidden.

The information contained herein has been obtained from sources believed to be reliable and trusted or have been verified. Telekom Security can take liability for completeness, accuracy and correctness only in so far, as gross negligence or intention create liability. Any liability beyond it, in particular possible damages resulting from using or non-usability of the information contained herein, is excluded.