# Check Point response to CVE-2023-51764 - Postfix SMTP Smuggling vulnerability

**Product**  ClusterXL, Maestro HyperScale Firewall, Scalable Chassis, Security Gateways, VSX (Traditional)

**Version**  R81 (EOS), R81.10 (EOS), R81.20

**OS**  Gaia

**Last Modified**  2025-01-30

## Symptoms

- The vulnerability involves a composition of two email services they handle non-standard forms of the SMTP "End-of-DATA" sequence in different ways.

An SMTP Client can smuggle emails inside headers of other emails between these email services.

This allows the SMTP Client to spoof the `MAIL FROM` and `RCPT TO` address and bypass SPF protection mechanism.

**References:**

- [CVE-2023-51764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51764)
  - [Postfix SMTP Smuggling](https://www.postfix.org/smtp-smuggling.html)
- This article applies to Security Gateway / Cluster / Scalable Platform Security Group with Mail Transfer Agent (MTA) enabled (Check Point MTA uses Postfix).

## Cause

Postfix supports `<LF>.<CR><LF>`, which can result in email smuggling, unless configured to forbid newline (`smtpd_discard_ehlo_keywords=chunking`) and pipelining (`smtpd_data_restrictions=reject_unauth_pipelining`).

## Solution

This problem was fixed ( **requires manual configuration**). The fix is included starting from:

- [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127)
- [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 54
- [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 141
- [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 99
- [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 211

**Required Configuration after installing the required Jumbo Hotfix Accumulator:**

1. Connect to command line on Security Gateway / each Cluster Member / Scalable Platform Security Group over SSH.

2. Log in to the Expert mode.

3. Check if the _$FWDIR/conf/mta_postfix_options.cf_ file already exists:
   
   `ls -l $FWDIR/conf/mta_postfix_options.cf`

If this file does not exist, then create it:
   
   `touch $FWDIR/conf/mta_postfix_options.cf`

4. Edit the _$FWDIR/conf/mta_postfix_options.cf_ file:
   
   `vi $FWDIR/conf/mta_postfix_options.cf`

5. Add these parameters:
   
   `smtpd_forbid_unauth_pipelining = yes`
   
   `smtpd_forbid_bare_newline = yes`
   
   `smtpd_discard_ehlo_keywords = chunking,pipelining,silent-discard`

Note - Refer to official [Postfix Configuration Parameters](https://www.postfix.org/postconf.5.html) page.

6. Save the changes in the file and exit from Vi editor.

7. On a Scalable Platform Security Group, copy the modified file to all Security Group Members:
   
   `asg_cp2blades $FWDIR/conf/mta_postfix_options.cf`

8. In SmartConsole, install the Threat Prevention policy on the Security Gateway / Cluster object.

**SPF must be enabled and enforced on MTA to block emails. To configure SPF follow sk146412: MTA support for Sender Policy Framework (SPF)**

#### NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

## Article Properties

**Access Level**  General

**Status**  Approved by TAC

**Date Created**  2024-01-28

**Last Modified**  2025-01-30