University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
No history.
Information
Published : 2018-11-25 10:29
Updated : 2023-11-07 02:55
NVD link : CVE-2018-19518
Mitre link : CVE-2018-19518
CVE.ORG link : CVE-2018-19518
JSON object : View
Products Affected
debian
- debian_linux
canonical
- ubuntu_linux
php
- php
uw-imap_project
- uw-imap
CWE
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')