Date: Mon, 26 Dec 2016 15:46:50 +0100 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: PHPMailer < 5.2.18 Remote Code Execution [CVE-2016-10033] Hi, Given I had plenty of time on the train to 33c3 I did a quick lookaround on what contains PHPMailer. As the details of the vuln aren't clear yet this doesn't necessarily mean they're vulnerable, just that they ship the affected code. The most popular webapps that directly ship PHPmailer seem to be Joomla and Mantis. Both without an update yet. Wordpress also ships PHPmailer, but this confused me at first. They renamed it and it's called class-phpmailer.php (if you use some automatic detection for vulnerable PHPMailer versions - as I do in freewvs - you may miss that one). Also no update yet. Drupal doesn't contain PHPMailer, although mentioned in the advisory. But there are probably plugins and extensions using it. I also saw it used in some wordpress themes. Owncloud and CMS Made Simple don't ship PHPMailer in their current versions, but in older versions. This may deserve some closer investigation if the files are leftover after updates and pose still a risk. Summary: Affected popular Webapps with plain PHPMailer: Joomla Mantis Affected popular webapps with modified / renamed PHPMailer: Wordpress Affected popular webapps which contained PHPMailer in older versions: CMS Made Simple Owncloud -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ