NVD Vulnerability Detail

CVE-2017-15806

Summary	The send function in the ezcMailMtaTransport class in Zeta Components Mail before 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address, as demonstrated by one containing "-X/path/to/wwwroot/file.php."
Publication Date	Nov. 16, 2017, 1:29 a.m.
Registration Date	Jan. 26, 2021, 1:17 p.m.
Last Update	Nov. 21, 2024, 12:15 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:zetacomponents:mail::::::::					1.8.2

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/101866	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/101866	Third Party Advisory VDB Entry
3	https://github.com/zetacomponents/Mail/issues/58	Issue Tracking Third Party Advisory
4	https://github.com/zetacomponents/Mail/issues/58	Issue Tracking Third Party Advisory
5	https://github.com/zetacomponents/Mail/releases/tag/1.8.2	Issue Tracking Release Notes Third Party Advisory
6	https://github.com/zetacomponents/Mail/releases/tag/1.8.2	Issue Tracking Release Notes Third Party Advisory
7	https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/	Issue Tracking Third Party Advisory
8	https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-critical-rce-vulnerability/	Issue Tracking Third Party Advisory
9	https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/	Issue Tracking Third Party Advisory
10	https://kay-malwarebenchmark.github.io/blog/cve-2017-15806-yuan-cheng-dai-ma-zhi-xing-lou-dong/	Issue Tracking Third Party Advisory
11	https://www.exploit-db.com/exploits/43155/	Issue Tracking Third Party Advisory VDB Entry
12	https://www.exploit-db.com/exploits/43155/	Issue Tracking Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-94	コード・インジェクション	https://cwe.mitre.org/data/definitions/94.html

JVN Vulnerability Information

Zeta Components Mail におけるコードインジェクションの脆弱性

Title	Zeta Components Mail におけるコードインジェクションの脆弱性
Summary	Zeta Components Mail には、コードインジェクションの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 12, 2017, midnight
Registration Date	Dec. 11, 2017, 4 p.m.
Last Update	Dec. 11, 2017, 4 p.m.

Affected System

Zeta Components

Zeta Components Mail 1.8.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-15806	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15806
National Vulnerability Database (NVD)
2	CVE-2017-15806	https://nvd.nist.gov/vuln/detail/CVE-2017-15806

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-94	https://jvndb.jvn.jp/ja/cwe/CWE-94.html

ベンダー情報

No	Name	URL
GitHub
1	Mail 1.8.2 released	https://github.com/zetacomponents/Mail/releases/tag/1.8.2
2	Restrict characters that can be used for the returnPath property of ezcMail (CVE-2017-15806) #58	https://github.com/zetacomponents/Mail/issues/58

Change Log

No	Changed Details	Date of change
0	[2017年12月11日] 掲載	Feb. 17, 2018, 10:37 a.m.