The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath, or (3) Sender header.

Dawid Golunski from LegalHackers discovered that PHP Swift Mailer, a mailing solution for PHP, did not correctly validate user input. This allowed a remote attacker to execute arbitrary code by passing specially formatted email addresses in specific email headers.

Dawid Golunski from legalhackers-com [1] discovered that the mail transport in Swift Mailer allowed remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \' (backslash double quote) in a crafted e-mail address in the From, ReturnPath, or Sender header.

[1] https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Ex ec-CVE-2016-10074-Vuln.html

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.5-1+deb7u1.

We recommend that you upgrade your libphp-swiftmailer packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

**Version 5.4.5** (2016-12-29)

  - SECURITY FIX: fixed CVE-2016-10074 by disallowing     potentially unsafe shell characters

    Prior to 5.4.5, the mail transport     (Swift_Transport_MailTransport) was vulnerable to     passing arbitrary shell arguments if the 'From',     'ReturnPath' or 'Sender' header came from a non-trusted     source, potentially allowing Remote Code Execution

  - deprecated the mail transport

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
96668	Debian DSA-3769-1 : libphp-swiftmailer - security update	Nessus	Debian Local Security Checks	critical
96636	Debian DLA-792-1 : libphp-swiftmailer security update	Nessus	Debian Local Security Checks	critical
96356	Fedora 25 : php-swiftmailer (2016-f7ef82c1b4)	Nessus	Fedora Local Security Checks	critical
96354	Fedora 24 : php-swiftmailer (2016-b65e546846)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2016-10074

critical

Tenable Plugins

critical

critical

critical

critical