UPDATE: 28 DEC 2016 - Critical security update for CVE-2016-10045 please update again ASAP. This is in addition to CVE-2016-10033 as fixed in 5.2.18. You should update to 5.2.20 at a minimum. Vulnerability: PHPMailer < 5.2.20 Remote Code Execution [CVE-2016-10033] Severity: CRITICAL ISC recommended action: Patch...now. This is a very popular application, left unpatched it will be exploited. Finder: Dawid Golunski (@dawid_golunski), https://legalhackers.com PHPMailer Description https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html Patching Changelog: https://github.com/PHPMailer/PHPMailer/blob/master/changelog.md Clone or download: https://github.com/PHPMailer/PHPMailer |
Russ McRee 203 Posts ISC Handler Dec 28th 2016 |
Thread locked Subscribe |
Dec 28th 2016 5 years ago |
PoC
https://legalhackers.com/exploits/CVE-2016-10045/PHPMailer_RCE_exploit.pl Fix (to version 5.2.18) brings another vuln - CVE-2016-10045 "CVE-2016-10045: Critical RCE vulnerability introduced in 5.2.18" https://github.com/PHPMailer/PHPMailer/issues/924 |
acbeko 13 Posts |
Quote |
Dec 28th 2016 5 years ago |
Wordpress stated that it is not vulnerable to this....
"Presently, WordPress Core (and as a result, anything utilising wp_mail()) are unaffected by the recent disclosures, the vulnerabilities require the usage of a PHPMailer feature which WordPress & wp_mail() does not use. This applies to WordPress 4.7, 4.6.x, and all previous secure versions." Src: https://core.trac.wordpress.org/ticket/37210 However, they do state that the PHPMailer library is shipped with WordPress and that they will update the library to latest with an upcoming release. Not sure why they ship releases with the library unless some part of the WordPress code uses bits of PHPMailer. Also, the patch did not fix the vulnerability. You want to update to 5.2.20. |
Anonymous |
Quote |
Dec 28th 2016 5 years ago |
There appears to be an update for the update. Version 5.2.21 is current at the moment.
|
Ron 8 Posts |
Quote |
Dec 29th 2016 5 years ago |
Sign Up for Free or Log In to start participating in the conversation!