CVE-2018-19518

2018-11-2500:00:00

ubuntu.com

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.969

Percentile

99.7%

JSON

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open()
in PHP and other products, launches an rsh command (by means of the
imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in
osdep/unix/tcp_unix.c) without preventing argument injection, which might
allow remote attackers to execute arbitrary OS commands if the IMAP server
name is untrusted input (e.g., entered by a user of a web application) and
if rsh has been replaced by a program with different argument semantics.
For example, if rsh is a link to ssh (as seen on Debian and Ubuntu
systems), then the attack can use an IMAP server name containing a
“-oProxyCommand” argument.

Bugs

Notes

Author	Note
mdeslaur	php5 in precise and trusty doesn’t build imap, it is in a separate php-imap source package.
msalvatore	uw-imap has been defunct since 2008.

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchphp-imap< 5.4.6-0ubuntu5.1UNKNOWN
ubuntu16.04noarchphp7.0< 7.0.33-0ubuntu0.16.04.1UNKNOWN
ubuntu18.04noarchphp7.2< 7.2.15-0ubuntu0.18.04.1UNKNOWN
ubuntu18.10noarchphp7.2< 7.2.15-0ubuntu0.18.20.1UNKNOWN
ubuntu19.04noarchphp7.2< 7.2.15-0ubuntu2UNKNOWN
ubuntu18.04noarchuw-imap< 8:2007f~dfsg-5ubuntu0.18.04.2UNKNOWN
ubuntu19.04noarchuw-imap< 8:2007f~dfsg-5ubuntu0.19.04.2UNKNOWN
ubuntu14.04noarchuw-imap< 8:2007f~dfsg-2ubuntu0.1~esm1UNKNOWN
ubuntu16.04noarchuw-imap< 8:2007f~dfsg-4+deb8u1build0.16.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	php-imap	< 5.4.6-0ubuntu5.1	UNKNOWN
ubuntu	16.04	noarch	php7.0	< 7.0.33-0ubuntu0.16.04.1	UNKNOWN
ubuntu	18.04	noarch	php7.2	< 7.2.15-0ubuntu0.18.04.1	UNKNOWN
ubuntu	18.10	noarch	php7.2	< 7.2.15-0ubuntu0.18.20.1	UNKNOWN
ubuntu	19.04	noarch	php7.2	< 7.2.15-0ubuntu2	UNKNOWN
ubuntu	18.04	noarch	uw-imap	< 8:2007f~dfsg-5ubuntu0.18.04.2	UNKNOWN
ubuntu	19.04	noarch	uw-imap	< 8:2007f~dfsg-5ubuntu0.19.04.2	UNKNOWN
ubuntu	14.04	noarch	uw-imap	< 8:2007f~dfsg-2ubuntu0.1~esm1	UNKNOWN
ubuntu	16.04	noarch	uw-imap	< 8:2007f~dfsg-4+deb8u1build0.16.04.1	UNKNOWN