[security-alerts] FW: [SA17763] PHP "mb_send_mail()" "To:" Header Injection Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> PHP "mb_send_mail()" "To:" Header Injection Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA17763
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/17763/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> Security Bypass, Manipulation of data
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> PHP 4.4.x
> http://secunia.com/product/5768/
> PHP 5.0.x
> http://secunia.com/product/3919/
> 
> DESCRIPTION:
> s.masugata has reported a vulnerability in PHP, which potentially can
> be exploited by malicious people to use it as an open mail relay.
> 
> The vulnerability is caused due to an input validation error in the
> "mb_send_mail()" function. This can be exploited to inject arbitrary
> headers in a mail sent via a script calling the "mb_send_mail()"
> function where the "To" parameter can be controlled by the attacker.
> 
> SOLUTION:
> Update to version 5.1.0.
> http://www.php.net/downloads.php
> 
> Do not call the "mb_send_mail()" function in scripts where input
> passed to the "To" parameter originates from untrusted sources.
> 
> PROVIDED AND/OR DISCOVERED BY:
> s.masugata
> 
> ORIGINAL ADVISORY:
> The PHP Group:
> http://www.php.net/release_5_1_0.php
> 
> s.masugata:
> http://bugs.php.net/bug.php?id=35307
> 
> ----------------------------------------------------------------------