PHPMailer Data() Function Remote Denial of Service Vulnerability
BID:13805
Info
PHPMailer Data() Function Remote Denial of Service Vulnerability
| Bugtraq ID: | 13805 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2005-1807 |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2005 12:00AM |
| Updated: | Jun 18 2007 07:59PM |
| Credit: | Discovery is credited to Mariano Nunez Di Croce from CYBSEC. |
| Vulnerable: |
Xoops Xoops 2.0.12 a Xoops Xoops 2.0.12 Xoops Xoops 2.0.11 Xoops Xoops 2.0.10 Xoops Xoops 2.0.9 .3 Xoops Xoops 2.0.9 .2 Xoops Xoops 2.0.5 .2 Xoops Xoops 2.0.5 .1 Xoops Xoops 2.0.5 Xoops Xoops 2.0.3 Xoops Xoops 2.0.2 Xoops Xoops 2.0.1 Xoops Xoops 2.0 PHPMailer PHPMailer 1.7.2 PHPMailer PHPMailer 1.7.1 PHPMailer PHPMailer 1.7 PHP Link Directory PHPLD 2.0 IPplan IPplan 4.85 |
| Not Vulnerable: |
Xoops Xoops 2.2.1 PHPMailer PHPMailer 1.7.3 IPplan IPplan 4.86 |
Discussion
PHPMailer Data() Function Remote Denial of Service Vulnerability
PHPMailer is affected by a remote denial-of-service vulnerability.
An attacker can send an email message with a malformed header field to initiate an infinite loop in the application. This eventually leads to a crash due to resource exhaustion.
PHPMailer 1.72 and prior versions are affected by this issue.
PHPMailer is affected by a remote denial-of-service vulnerability.
An attacker can send an email message with a malformed header field to initiate an infinite loop in the application. This eventually leads to a crash due to resource exhaustion.
PHPMailer 1.72 and prior versions are affected by this issue.
Exploit / POC
PHPMailer Data() Function Remote Denial of Service Vulnerability
An exploit is not required.
The following proof of concept is available:
From: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... x 998
An exploit is not required.
The following proof of concept is available:
From: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA... x 998
Solution / Fix
PHPMailer Data() Function Remote Denial of Service Vulnerability
Solution:
The vendor has addressed this issue in PHPMailer 1.7.3.
Xoops has released an update regarding this issue. Please see the referenced Xoops web page for more information.
IPplan IPplan 4.85
PHPMailer PHPMailer 1.7
PHPMailer PHPMailer 1.7.1
PHPMailer PHPMailer 1.7.2
Xoops Xoops 2.0
Xoops Xoops 2.0.1
Xoops Xoops 2.0.10
Xoops Xoops 2.0.11
Xoops Xoops 2.0.12
Xoops Xoops 2.0.12 a
Xoops Xoops 2.0.2
Xoops Xoops 2.0.3
Xoops Xoops 2.0.5
Xoops Xoops 2.0.5 .1
Xoops Xoops 2.0.5 .2
Xoops Xoops 2.0.9 .3
Xoops Xoops 2.0.9 .2
Solution:
The vendor has addressed this issue in PHPMailer 1.7.3.
Xoops has released an update regarding this issue. Please see the referenced Xoops web page for more information.
IPplan IPplan 4.85
-
IPplan ipplan-4.86.tar.gz
http://downloads.sourceforge.net/iptrack/ipplan-4.86.tar.gz?modtime=11 82153486&big_mirror=0
PHPMailer PHPMailer 1.7
-
PHPMailer phpmailer-1.73.tar.gz
http://prdownloads.sourceforge.net/phpmailer/phpmailer-1.73.tar.gz?dow nload
PHPMailer PHPMailer 1.7.1
-
PHPMailer phpmailer-1.73.tar.gz
http://prdownloads.sourceforge.net/phpmailer/phpmailer-1.73.tar.gz?dow nload
PHPMailer PHPMailer 1.7.2
-
PHPMailer phpmailer-1.73.tar.gz
http://prdownloads.sourceforge.net/phpmailer/phpmailer-1.73.tar.gz?dow nload
Xoops Xoops 2.0
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.1
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.10
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.11
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.12
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.12 a
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.2
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.3
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.5
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.5 .1
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.5 .2
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.9 .3
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
Xoops Xoops 2.0.9 .2
-
Xoops Xoops 2.2.1
http://www.xoops.org/modules/core/visit.php?cid=7&lid=85
References
PHPMailer Data() Function Remote Denial of Service Vulnerability
References:
References:
- Bug for libs in php link directory (PHP Link Directory)
- IPplan 4.86 Release Notes (IPplan)
- PHPMailer Data() Function Infinite Loop Lets Remote Users Deny Service (SecurityTracker)
- PHPMailer Home Page (PHPMailer)
- Project Homepage (IPplan)
- ProManager Homepage (Promanager)
- Xoops 2.2.1 released (Xoops)
- XOOPS Web Site (XOOPS)
- Bug for libs in php link directory 2.0 (Mario Oyorzabal Salgado
) - CYBSEC - PHPMailer Infinite Loop Denial of Service (=?ISO-8859-1?Q?Mariano_Nu=F1ez_Di_Croce?=
)