> Source: [sk181944](https://support.checkpoint.com/results/sk/sk181944)

# sk181944 - Check Point response to CVE-2023-51764 - Postfix SMTP Smuggling vulnerability

| Property | Value |
|----------|-------|
| Solution ID | sk181944 |
| Date Created | 2024-01-28 |
| Last Modified | 2025-01-30 |
| Technical Level | General |
| Products | Security Gateway, Scalable Platforms |
| Versions | R81.20, R81.10 (EOS), R81 (EOS), R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * The vulnerability involves a composition of two email services they handle non-standard forms of the SMTP "End-of-DATA" sequence in different ways.

  An SMTP Client can smuggle emails inside headers of other emails between these email services.

  This allows the SMTP Client to spoof the "`MAIL FROM`" and "`RCPT TO`" address and bypass SPF protection mechanism.

  References:
  * [CVE-2023-51764](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51764)
  * <https://www.postfix.org/smtp-smuggling.html>
* This article applies to Security Gateway / Cluster / Scalable Platform Security Group with Mail Transfer Agent (MTA) enabled (Check Point MTA uses Postfix).

## Cause

Postfix supports `<LF>.<CR><LF>`, which can result in email smuggling, unless configured to forbid newline (`smtpd_discard_ehlo_keywords=chunking`) and pipelining (`smtpd_data_restrictions=reject_unauth_pipelining`).

## Solution

This problem was fixed (**requires manual configuration**). The fix is included starting from:

* [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127)
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 54
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 141
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 99
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 211

<br />

**Required Configuration after installing the required Jumbo Hotfix Accumulator:**

1. Connect to command line on Security Gateway / each Cluster Member / Scalable Platform Security Group over SSH.

2. Log in to the Expert mode.

3. Check if the *$FWDIR/conf/mta_postfix_options.cf* file already exists:

   `ls -l $FWDIR/conf/mta_postfix_options.cf`

   If this file does not exist, then create it:

   `touch $FWDIR/conf/mta_postfix_options.cf`
4. Edit the *$FWDIR/conf/mta_postfix_options.cf* file:

   `vi $FWDIR/conf/mta_postfix_options.cf`
5. Add these parameters:

   `smtpd_forbid_unauth_pipelining = yes`

   `smtpd_forbid_bare_newline = yes`

   `smtpd_discard_ehlo_keywords = chunking,pipelining,silent-discard `
   Note - Refer to official [Postfix Configuration Parameters](https://www.postfix.org/postconf.5.html) page.
6. Save the changes in the file and exit from Vi editor.

7. On a Scalable Platform Security Group, copy the modified file to all Security Group Members:

   `asg_cp2blades $FWDIR/conf/mta_postfix_options.cf`
8. In SmartConsole, install the Threat Prevention policy on the Security Gateway / Cluster object.  

   **\*\*\*SPF must be enabled and enforced on MTA to block emails. To configure SPF follow sk146412: MTA support for Sender Policy Framework (SPF)**   

   <br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content