Hat jemand erforscht, inwiefern
SMTP Smuggling
(https://sec-consult.com/blog/detail/sm…ails-worldwide/) der aktuelle Grund, Postfix zu patchen und Cisco secure gateway korrekt zu konfigurieren, für Exim nicht zutrifft? Etwa weil exim sich an die RFCs hält?
Wie kommst drauf, dass Exim nicht betroffen sein sollte? Postfix über SEC Consult (großartiger Talk übrigens am 37C3):
Days before a 10+ day holiday break and associated production change freeze, SEC Consult has published an email spoofing attack that involves a composition of email services with specific differences in the way they handle line endings other than <CR><LF>.
Unfortunately, criticial information provided by the researcher was not passed on to Postfix maintainers before publication of the attack, otherwise we would certainly have convinced SEC Consult to postpone publication until after people had a chance to update their Postfix or other affected systems.
The net result: a presumably unintended zero-day attack was published because some people weren't aware of the scope of the attack.
Technically, the attack explots END-OF-DATA confusion by sending <LF>.<LF> or <LF>.<CR><LF> instead of <CR><LF>.<CR><LF>. The vulnerability was introduced many decades ago in Sendmail, by allowing the non-standard <LF> line ending in addition to the standard <CR><LF>. For compatibility with programs that expect Sendmail behavior, the non-standard <LF> line ending was also allowed by other SMTP servers including Postfix and Exim.
WTF? Gesundheitsdaten! Das Beste ist, dass seine Versicherungsagentur sehr wohl verschlüsselt kommuniziert, er aber mit seiner Domäne wegschicken will (und sich daher alle Verträge, ... weiterleitet)
