<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>From:<br>
</p>
<p><a class="moz-txt-link-freetext" href="https://blog.zimbra.com/2023/12/zimbra-and-smtp-smuggling-attack-on-postfix/">https://blog.zimbra.com/2023/12/zimbra-and-smtp-smuggling-attack-on-postfix/</a></p>
<p><br>
</p>
<p>Recently an <a
href="https://www.postfix.org/smtp-smuggling.html"
target="_blank" rel="noopener">SMTP Smuggling attack on Postfix</a>
was published, as mentioned by the Postfix project:</p>
<p><em>Days before a 10+ day holiday break and associated production
change freeze, SEC Consult has published an email spoofing
attack that involves a composition of email services with
specific differences in the way they handle line endings other
than <CR><LF>.</em></p>
<p><em>Unfortunately, criticial information provided by the
researcher was not passed on to Postfix maintainers before
publication of the attack, otherwise we would certainly have
convinced SEC Consult to postpone publication until after people
had a chance to update their Postfix or other affected systems.</em></p>
<p><em>The net result: a presumably unintended zero-day attack was
published because some people weren’t aware of the scope of the
attack.</em></p>
<p>At this time it means an upstream fix by Postfix is needed to
fully fix the security issue.</p>
<p>Zimbra will create a patch with updated configuration files and
an updated version of Postfix as soon as possible, meanwhile we
recommend to add:</p>
<pre class="EnlighterJSRAW" data-enlighter-language="generic">smtpd_discard_ehlo_keywords=chunking</pre>
<p> </p>
<p>To the bottom of all the following files:</p>
<pre class="EnlighterJSRAW" data-enlighter-language="generic">/opt/zimbra/common/conf/main.cf
/opt/zimbra/common/conf/main.cf.default
/opt/zimbra/common/conf/main.cf.proto</pre>
<p> </p>
<p>And then as the OS user <em>zimbra</em> restart the MTA:</p>
<pre class="EnlighterJSRAW" data-enlighter-language="generic">zmmtactl restart
</pre>
<p>The following line should already be set in the configuration
files, but be sure to check if it is indeed present on your
installation:</p>
<pre class="EnlighterJSRAW" data-enlighter-language="generic">smtpd_data_restrictions = reject_unauth_pipelining</pre>
<p></p>
</body>
</html>