Re: New SMTP smuggling attack

[nightmare.yeah27 () aceecat org]

On Mon, Apr 29, 2024 at 08:19:52PM GMT, Mark Esler wrote:

> To mitigate future end-of-data sequence attacks, like SMTP
> Smuggling, MTAs should comply with RFC 5321 section 4.1.1.4 [0] to
> strip control characters other than <SP>, <HT>, <CR>, and <LF> in
> the DATA section of SMTP messages.

[...]

> As per RFC 2119 section 3 [2], the word *SHOULD* implies *MUST*
> unless you have a valid reason not to--which is never the case for
> these _forbidden_ sequences in DATA. This is why RFC 5321 4.1.1.4's
> _SHOULD avoid_ implies _needs to strip_.

I don't see that stripping specifically is implied.

> What are the benefits and risks of stripping ASCII NUL and other
> control characters from SMTP DATA?

What is the benefit of stripping versus the much more natural option
of rejecting such messages?

One possible consequence of passing messages along in an altered form
is that various signatures may break.

-- 
Ian