SANS Stormcast Thursday, November 5th, 2026: Email Test Scripts; runZero oobscan BMC/IPMI; apt Signature Bypass (CVE-2026-109518); SonicWall GMS EOL Unpatched Flaws

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10166.mp3

previous

Email Test Scripts; runZero oobscan BMC/IPMI; apt Signature Bypass (CVE-2026-109518); SonicWall GMS EOL Unpatched Flaws

00:00

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

Login here to join the discussion.

Podcast Transcript

 Hello and welcome to the Thursday, November 5th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in
 Cybersecurity Engineering. Well today's diary I titled it
 with the classics return. One of the first sort of web
 vulnerabilities that I've sort of experienced, worked with
 was an old email script vulnerability for FormMail that
 had a number of issues. So one was where it sort of would
 leak environment variables but could also be used to send
 spam to anybody in some versions. Now what I noticed
 in our web honeypot logs today was a number of different
 requests for script like sendmail.php, test-mail.php.
 Now what this I think looks for is, and I found a couple
 of these scripts, is these are scripts that you may deploy in
 development to just check your email configuration. These
 scripts will also send email to random email addresses that
 you specify as part of a GET or POST parameter. Two issues
 with this. First of all, yes, just like the good old FormMail
 script, these scripts will leak environment variables and
 server configuration. So that's one problem. But it can
 also be abused by a spammer to send email to arbitrary email
 addresses. Make sure you're not deploying them in
 production. Apparently enough people are doing so for
 attackers to make it worthwhile to actually scan
 for these scripts. So I think the real problem here is how
 do you manage moving code live and how do you sort of manage
 your entire sort of production environment and your build
 pipeline. That's sort of where these checks probably should
 be implemented that something like this never makes it to a
 production site. And then we've got an interesting new
 tool, OOB scan, out-of-band scan from H.D. Moore with
 runZero. This tool scans your network for exposed baseboard
 management controllers, IPMI, SNMP, and various other things
 that could be used to control systems, often used sort of as
 part of like these out-of-band management tools. Well, that's
 the name of the tool to manage servers. I just ran it before
 the podcast against my home network and definitely my AI
 agent has some work to do later to clean up some of the
 things that found, like found a printer that had SNMP
 enabled. I didn't know about, never use it. So that's one of
 the things that's going to be disabled. Yes, it's sort of a
 better port scanner, but it's really focused on these out-of
 -band management interfaces, like also IP KVMs and such. It
 finds that are found by other tools, but this one will give
 you all the details. It will flag any specific
 vulnerabilities it found on these systems. So it's more
 than a port scanner. It's really more of a very focused
 and very full feature in that sense, a vulnerability scanner
 for these type of devices. Well, then we have a critical
 vulnerability in apt, the script that you typically use
 to manage packages on Debian systems. This vulnerability is
 triggered by sending error messages from the web server,
 serving apt packages. And if you do it right, well then apt
 will not verify the signature on this package. So this
 allows the attacker to inject malicious packages for the
 system to download and install. This is particularly
 an issue because apt still doesn't always use HTTPS. So
 in order to trigger this vulnerability, an attacker
 does not have to have actually control of the endpoint. It's
 sufficient to then inject data on path. So another thing that
 you may want to look at if you're still using HTTP for
 apt, maybe switch to HTTPS. That may be an option
 depending on your distribution. Ubuntu, I think
 by default still does HTTP, not HTTPS. Then I got some bad
 news for you. If you're using SonicWall's GMS appliance,
 their global management system, well this product has
 been out of support and end of life for a while now. And
 there is a new vulnerability, one that does allow
 unauthenticated file read and then also an authenticated SQL
 injection vulnerability. Well, neither will be fixed. So your
 only option is really to check with SonicWall what else to
 give the money for that will replace GMS if you still need
 something with this feature set. It's a virtual appliance,
 so you can't really upgrade it by throwing it into the trash.
 I guess you can still just delete it or throw it into the
 desktop trash can. Well, and this is it for today. So
 thanks again for listening. Thanks for liking. Thanks for
 recommending this podcast and talk to you again tomorrow.
 Bye.