zend-mail remote code execution via Sendmail adapter
Impact
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 2.4.11Ecosystem versions | 2.4.11 |
| From 2.5 through 2.5.2 (inclusive)Ecosystem versions | Not recorded |
| From 2.6 through 2.6.2 (inclusive)Ecosystem versions | Not recorded |
| From 2.7 before 2.7.2Ecosystem versions | 2.7.2 |
Version evidence: OSV · GHSA-r9mw-gwx9-v3h5
View original version evidence (63 explicit versions)
Original source description
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2016-10034
- Security advisory framework.zend.com/security/advisory/ZF2016-04
- Source reference github.com/zendframework/zend-mail
- Security advisory legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html
- Source reference security.gentoo.org/glsa/201804-10
- Public exploit reference www.exploit-db.com/exploits/40979
- Public exploit reference www.exploit-db.com/exploits/40986
- Public exploit reference www.exploit-db.com/exploits/42221
- Source reference www.securityfocus.com/bid/95144
- Source reference www.securitytracker.com/id/1037539