CVE-2016-10034 zend-mail remote code execution via Sendmail adapter
Remote attackers can execute arbitrary code by injecting commands via crafted email addresses in the Zend Mail Sendmail adapter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10034?
CVE-2016-10034 is a critical command injection vulnerability in n/a, published on 30 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address.
Weakness: CWE-77
Which versions are affected by CVE-2016-10034?
8 open source packages ship an affected version, including zendframework/zend-mail. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
zendframework/zend-mail Packagist | All versions | 2.4.11 |
zendframework/zend-mail Packagist | All versions | 2.4.11 |
zendframework/zend-mail Packagist | From 2.5 to 2.5.2 | None |
zendframework/zend-mail Packagist | From 2.5 to 2.5.2 | None |
zendframework/zend-mail Packagist | From 2.6 to 2.6.2 | None |
zendframework/zend-mail Packagist | From 2.6 to 2.6.2 | None |
2 more packages
zendframework/zend-mail Packagist | From 2.7 | 2.7.2 |
zendframework/zend-mail Packagist | From 2.7 | 2.7.2 |
Products include Zend Zend-Mail, Zend Zend Framework.
How do I fix CVE-2016-10034?
Upgrade zendframework/zend-mail to a fixed version for your release line: 2.4.11 or 2.7.2.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-10034 being exploited?
There is no known exploitation of CVE-2016-10034 in the wild and no public exploit code.
Public exploit code: 3 Exploit-DB entries and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-r9mw-gwx9-v3h5, MGASA-2017-0016.