F5 Networks BIG-IP : PHPMailer vulnerability (K74977440)

High Nessus Plugin ID 100182

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

The mailSend function in the isMail transport in PHPMailer before 5.2.18, when the Sender property is not set, might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \' (backslash double quote) in a crafted From address. (CVE-2016-10033)

Solution

Upgrade to one of the non-vulnerable versions listed in the F5 Solution K74977440.

See Also

https://support.f5.com/csp/article/K74977440

Plugin Details

Severity: High

ID: 100182

File Name: f5_bigip_SOL74977440.nasl

Version: 3.10

Type: local

Published: 2017/05/16

Updated: 2019/07/17

Dependencies: 76940

Configuration: Enable paranoid mode

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:f5:big-ip_access_policy_manager, cpe:/a:f5:big-ip_advanced_firewall_manager, cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_application_security_manager, cpe:/a:f5:big-ip_application_visibility_and_reporting, cpe:/a:f5:big-ip_global_traffic_manager, cpe:/a:f5:big-ip_link_controller, cpe:/a:f5:big-ip_local_traffic_manager, cpe:/a:f5:big-ip_policy_enforcement_manager, cpe:/a:f5:big-ip_webaccelerator, cpe:/h:f5:big-ip, cpe:/h:f5:big-ip_protocol_security_manager

Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version, Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/01/23

Vulnerability Publication Date: 2016/12/30

Exploitable With

Core Impact

Metasploit (WordPress PHPMailer Host Header Command Injection)

Reference Information

CVE: CVE-2016-10033