CVE-2023-51765

Vulnerability

A vulnerability exists in sendmail versions through 8.17.2 that allows SMTP smuggling in specific configurations. The issue arises because sendmail accepts . as a valid end-of-message indicator, while other popular mail servers do not recognize this sequence. When sendmail receives a message with an embedded . sequence, it may interpret it as an early end-of-message, allowing an attacker to inject a second message with a spoofed MAIL FROM address. The vulnerability is resolved in sendmail 8.18 and later versions by requiring the 'o' flag in srv_features [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a crafted email via a vulnerable sendmail server. The attacker needs network access to communicate with the SMTP server and relies on the existence of a downstream mail server that uses differing end-of-message sequences. The exploitation technique, known as SMTP smuggling, involves embedding . within an email to prematurely terminate the first message and inject a second crafted email with a spoofed sender address [1][4].

Impact

Successful exploitation allows an attacker to inject email messages with a spoofed MAIL FROM address, effectively bypassing Sender Policy Framework (SPF) protection. This can enable targeted phishing attacks and email spoofing, undermining the integrity and authenticity of email communications [1][3].

Mitigation

The vulnerability is fixed in sendmail version 8.18 and later, where the 'o' flag in srv_features must be explicitly set to allow the vulnerable behavior. Users of sendmail 8.17.2 and earlier should upgrade to version 8.18 or later. If upgrading is not immediately possible, administrators can mitigate the issue by ensuring that sendmail does not accept . as an end-of-message indicator, though the specific configuration changes are not fully detailed in the available references [1][2][4].