OS Command Injection in Mgetty+Sendfax - CVE-2018-16744

Vulnerability identifier: #VU31210

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-16744

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow for command injection if untrusted input can reach it, because popen is used.

Mgetty+Sendfax
Opensuse
Fedora
mgetty
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)

Install update from vendor's website.

Mgetty+Sendfax - update to 1.2.1
mgetty - addressed in versions 1.1.37-10.fc28, 1.1.37-11.fc29
Dell EMC Unity XT Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity VSA Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity Operating Environment (OE) - update to 5.1.2.0.5.007

• https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty

• Multiple vulnerabilities in Mgetty+Sendfax
• OpenSUSE Linux update for mgetty
• OpenSUSE Linux update for mgetty
• Multiple vulnerabilities in Dell EMC Unity
• Fedora 29 update for mgetty
• Fedora 28 update for mgetty