The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote     attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \     (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender     header. (CVE-2016-10074)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote
    attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \"
    (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender
    header. (CVE-2016-10074)

Dawid Golunski from LegalHackers discovered that PHP Swift Mailer, a mailing solution for PHP, did not correctly validate user input. This allowed a remote attacker to execute arbitrary code by passing specially formatted email addresses in specific email headers.

Dawid Golunski from legalhackers-com [1] discovered that the mail transport in Swift Mailer allowed remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \' (backslash double quote) in a crafted e-mail address in the From, ReturnPath, or Sender header.

[1] https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Ex ec-CVE-2016-10074-Vuln.html

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.5-1+deb7u1.

We recommend that you upgrade your libphp-swiftmailer packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 5.4.5** (2016-12-29)

  - SECURITY FIX: fixed CVE-2016-10074 by disallowing     potentially unsafe shell characters

    Prior to 5.4.5, the mail transport     (Swift_Transport_MailTransport) was vulnerable to     passing arbitrary shell arguments if the 'From',     'ReturnPath' or 'Sender' header came from a non-trusted     source, potentially allowing Remote Code Execution

  - deprecated the mail transport

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
254565	Linux Distros Unpatched Vulnerability : CVE-2016-10074	Nessus	Misc.	Local	critical
434704	SCA: security update for swiftmailer/swiftmailer (GHSA-pr44-4jfr-286m)	Tenable Cloud Security	SCA Checks	Local	critical
434704	SCA: security update for swiftmailer/swiftmailer (GHSA-pr44-4jfr-286m)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
96668	Debian DSA-3769-1 : libphp-swiftmailer - security update	Nessus	Debian Local Security Checks	Local	critical
96636	Debian DLA-792-1 : libphp-swiftmailer security update	Nessus	Debian Local Security Checks	Local	critical
96356	Fedora 25 : php-swiftmailer (2016-f7ef82c1b4)	Nessus	Fedora Local Security Checks	Local	critical
96354	Fedora 24 : php-swiftmailer (2016-b65e546846)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-10074

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical