Fluid Attacks Database

Description

zend-mail remote code execution via Sendmail adapter The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a " (backslash double quote) in a crafted e-mail address.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	zendframework/zend-mail	>=0 <2.4.11 \|\| >=2.5 <=2.5.2 \|\| >=2.6 <=2.6.2 \|\| >=2.7 <2.7.2	2.4.11, 2.7.2

Aliases

1. CVE-2016-100342. NVD-2016-100343. OSV-2016-100344. GCVE-2016-100345. security.gentoo.org

References

1. https://framework.zend.com/security/advisory/ZF2016-042. https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html3. https://www.exploit-db.com/exploits/409794. https://www.exploit-db.com/exploits/409865. https://www.exploit-db.com/exploits/422216. http://www.securityfocus.com/bid/951447. http://www.securitytracker.com/id/10375398. https://github.com/heikipikker/exploit-CVE-2016-10034