PHP mb_send_mail() May Let Users Inject SMTP Headers
|
|
SecurityTracker Alert ID: 1015296
|
|
SecurityTracker URL: http://securitytracker.com/id?1015296
|
|
CVE Reference: CVE-2005-3883
(Links to External Site)
|
Date: Nov 30 2005
|
Impact: Modification of system information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 5.1.1
|
Description: A vulnerability was reported in PHP in the mb_send_mail() function. A user may be able to inject SMTP headers.
The mb_send_mail() function does not properly validate user supplied input in the 'To' header when sending mail. A user of an application
that invokes this function may be able to supply a specially crafted 'To' value to inject arbitrary headers into an outgoing e-mail
message.
This may facilitate the sending of SPAM.
The vulnerability resides in 'ext/mbstring/mbstring.c'.
s.masugata at
digicom.dnp.co dot jp reported this vulnerability.
|
Impact: A user may be able to inject SMTP headers to, for example, send SPAM via an affected application.
|
Solution: The vendor has issued a fixed version (5.1.1), available at:
http://www.php.net/downloads.php
|
Vendor URL: www.php.net/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 30 Nov 2005 01:00:37 -0500
Subject: PHP vulnerability -- header can be injected when using mb_send_mail()
|
http://bugs.php.net/bug.php?id=35307
CVE-2005-3883
|
|
