Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 26 Dec 2016 15:46:50 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: PHPMailer < 5.2.18 Remote Code Execution
 [CVE-2016-10033]

Hi,

Given I had plenty of time on the train to 33c3 I did a quick
lookaround on what contains PHPMailer. As the details of the vuln
aren't clear yet this doesn't necessarily mean they're vulnerable, just
that they ship the affected code.

The most popular webapps that directly ship PHPmailer seem to be Joomla
and Mantis. Both without an update yet.
Wordpress also ships PHPmailer, but this confused me at first. They
renamed it and it's called class-phpmailer.php (if you use some
automatic detection for vulnerable PHPMailer versions - as I do in
freewvs - you may miss that one). Also no update yet.

Drupal doesn't contain PHPMailer, although mentioned in the advisory.
But there are probably plugins and extensions using it. I also saw it
used in some wordpress themes.

Owncloud and CMS Made Simple don't ship PHPMailer in their current
versions, but in older versions. This may deserve some
closer investigation if the files are leftover after updates and pose
still a risk.

Summary:

Affected popular Webapps with plain PHPMailer:
Joomla
Mantis

Affected popular webapps with modified / renamed PHPMailer:
Wordpress

Affected popular webapps which contained PHPMailer in older versions:
CMS Made Simple
Owncloud

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ