[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 26 Dec 2016 15:46:50 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: PHPMailer < 5.2.18 Remote Code Execution
[CVE-2016-10033]
Hi,
Given I had plenty of time on the train to 33c3 I did a quick
lookaround on what contains PHPMailer. As the details of the vuln
aren't clear yet this doesn't necessarily mean they're vulnerable, just
that they ship the affected code.
The most popular webapps that directly ship PHPmailer seem to be Joomla
and Mantis. Both without an update yet.
Wordpress also ships PHPmailer, but this confused me at first. They
renamed it and it's called class-phpmailer.php (if you use some
automatic detection for vulnerable PHPMailer versions - as I do in
freewvs - you may miss that one). Also no update yet.
Drupal doesn't contain PHPMailer, although mentioned in the advisory.
But there are probably plugins and extensions using it. I also saw it
used in some wordpress themes.
Owncloud and CMS Made Simple don't ship PHPMailer in their current
versions, but in older versions. This may deserve some
closer investigation if the files are leftover after updates and pose
still a risk.
Summary:
Affected popular Webapps with plain PHPMailer:
Joomla
Mantis
Affected popular webapps with modified / renamed PHPMailer:
Wordpress
Affected popular webapps which contained PHPMailer in older versions:
CMS Made Simple
Owncloud
--
Hanno Böck
https://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
