oss-sec mailing list archives
Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033]
From: Hanno Böck <hanno () hboeck de>
Date: Mon, 26 Dec 2016 15:46:50 +0100
Hi, Given I had plenty of time on the train to 33c3 I did a quick lookaround on what contains PHPMailer. As the details of the vuln aren't clear yet this doesn't necessarily mean they're vulnerable, just that they ship the affected code. The most popular webapps that directly ship PHPmailer seem to be Joomla and Mantis. Both without an update yet. Wordpress also ships PHPmailer, but this confused me at first. They renamed it and it's called class-phpmailer.php (if you use some automatic detection for vulnerable PHPMailer versions - as I do in freewvs - you may miss that one). Also no update yet. Drupal doesn't contain PHPMailer, although mentioned in the advisory. But there are probably plugins and extensions using it. I also saw it used in some wordpress themes. Owncloud and CMS Made Simple don't ship PHPMailer in their current versions, but in older versions. This may deserve some closer investigation if the files are leftover after updates and pose still a risk. Summary: Affected popular Webapps with plain PHPMailer: Joomla Mantis Affected popular webapps with modified / renamed PHPMailer: Wordpress Affected popular webapps which contained PHPMailer in older versions: CMS Made Simple Owncloud -- Hanno Böck https://hboeck.de/ mail/jabber: hanno () hboeck de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Current thread:
- PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Dawid Golunski (Dec 25)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Hanno Böck (Dec 26)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Peter Bex (Dec 26)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Peter Bex (Dec 26)
- Re: [security] [oss-security] PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Michael Hess (Dec 26)
- Re: [security] [oss-security] PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Yannick Warnier (Dec 26)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Peter Bex (Dec 26)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Hanno Böck (Dec 26)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Tracy Reed (Dec 26)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Michael Hess (Dec 27)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Florian Pritz (Dec 27)
- Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Dawid Golunski (Dec 27)