Mgetty up to 1.2.0 fax/faxq-helper.c do_activate Shell Metacharacter command injection

Summaryinfo

A vulnerability labeled as critical has been found in Mgetty up to 1.2.0. Impacted is the function do_activate of the file fax/faxq-helper.c. The manipulation as part of Shell Metacharacter results in command injection. This vulnerability was named CVE-2018-16741. The attack needs to be approached locally. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Mgetty up to 1.2.0. It has been classified as critical. Affected is the function do_activate of the file fax/faxq-helper.c. The manipulation as part of a Shell Metacharacter leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.

The bug was discovered 09/11/2018. The weakness was presented 09/13/2018 (Website). The advisory is shared for download at lists.debian.org. This vulnerability is traded as CVE-2018-16741 since 09/09/2018. The exploitability is told to be easy. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

The vulnerability scanner Nessus provides a plugin with the ID 117436 (Debian DSA-4291-1 : mgetty - security update), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 171593 (SUSE Enterprise Linux Security Update for mgetty (SUSE-SU-2018:2850-1)).

Upgrading to version 1.2.1 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (117436). See VDB-124009, VDB-124010, VDB-124011 and VDB-124012 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Mgetty

Version

• 1.0
• 1.1
• 1.2.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion