CVE-2018-19518: canonical ubuntu_linux

Modified

AliasesMGASA-2018-0484SUSE-SU-2018:3986-1SUSE-SU-2018:3988-1+7 more

Published 25-11-2018Last modified 05-08-2024

Vulnerability summary

CVE-2018-19518 is a high (CVSS 8.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 96.11% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 7 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 29-11-2018)

Source freshness unavailable

How is this decided?

CVSS score

8.5/10

010

High · v2.0 (NVD)

EPSS score

96.11%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits7github, reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 2 · Duplicates 1

DLA-1608-1 DSA-4353-1 CVE-2018-1000859

Timeline

25-11-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

CVSS metrics

6 scores · 4 sources · 3 versions

v3.17.5v3.07.5v2.08.5

EPSS trend

Probability

96.11%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 96.11% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

7 found

githubUnverified
Php Imap Open Exploit
Maturity: poc
referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
referenceUnverified
Exploit Reference (bugs.php.net)
Maturity: unknown

Show all 7 exploits

referenceUnverified
Exploit Reference (antichat.com)
Maturity: unknown
referenceUnverified
Exploit Reference (bugs.php.net)
Maturity: unknown
exploit-databaseremotelinuxVerified
PHP imap_open - Remote Code Execution (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
php imap_open Remote Code Execution
exploit/linux/http/php_imap_open_rce
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-88Improper Neutralization of Argument Delimiters in a CommandThe product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse9 products

php53&distro=SUSE Linux Enterprise Server 11 SP4< 5.3.17-112.45.1
php53&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 5.3.17-112.45.1
php53&distro=SUSE Linux Enterprise Software Development Kit 11 SP4< 5.3.17-112.45.1
php5&distro=SUSE Linux Enterprise Module for Web and Scripting 12< 5.5.14-109.45.2
php5&distro=SUSE Linux Enterprise Software Development Kit 12 SP3< 5.5.14-109.45.2

Show all 9

Ubuntu4 products

php-imap< 5.4.6-0ubuntu5.1
php7.0< 7.0.33-0ubuntu0.16.04.1
php7.2< 7.2.15-0ubuntu0.18.04.1
uw-imap< 8:2007f~dfsg-2ubuntu0.1~esm1 | < 8:2007f~dfsg-4+deb8u1build0.16.04.1 | < 8:2007f~dfsg-5ubuntu0.18.04.2

Debian2 products

uw-imap< 8:2007f~dfsg-5+deb9u1 | < 8:2007f~dfsg-4+deb8u1 | < 8:2007f~dfsg-6
debian_linuxEOL8.0 | 9.0

Alpine1 product

php7< 7.1.29-r0

Canonical1 product

ubuntu_linuxEOL16.04 | 18.04 | 19.04

Mageia1 product

php< 5.6.39-1.mga6

Php1 product

php≥ 5.6.0, ≤ 5.6.38 | ≥ 7.0.0, ≤ 7.0.32 | ≥ 7.1.0, ≤ 7.1.24 | ≥ 7.2.0, ≤ 7.2.12

Uw-imap_project1 product

uw-imap2007f

8 vendors · 20 products

References

32 links

bugs.php.net/bug.php?id=77160X Refsource MISCVendor Advisory
www.exploit-db.com/exploits/45914/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
lists.debian.org/debian-lts-announce/2019/03/msg00001.htmlMailing ListX Refsource MLISTThird Party Advisory
security.netapp.com/advisory/ntap-20181221-0004/X Refsource CONFIRMThird Party Advisory
www.securitytracker.com/id/1042157VDB EntryX Refsource SECTRACKBroken Link
www.debian.org/security/2018/dsa-4353Vendor AdvisoryX Refsource DEBIANThird Party Advisory
github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.phpX Refsource MISCExploitThird Party AdvisoryREPORT
bugs.debian.org/913835X Refsource MISCMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2018/11/22/3X Refsource MISCExploitMailing ListThird Party AdvisoryREPORT
git.php.net?p=php-src.git%3Ba=commit%3Bh=e5bfea64c81ae34816479bb05d17cdffe45adddbX Refsource CONFIRM

Show all 32 references

www.securityfocus.com/bid/106018VDB EntryX Refsource BIDBroken Link
bugs.php.net/bug.php?id=76428X Refsource MISCExploitMailing ListVendor Advisory
bugs.debian.org/913775X Refsource MISCMailing ListThird Party Advisory
bugs.debian.org/913836X Refsource MISCMailing ListThird Party Advisory
antichat.com/threads/463395/X Refsource MISCExploitThird Party AdvisoryREPORT
bugs.php.net/bug.php?id=77153X Refsource MISCExploitMailing ListVendor Advisory
lists.debian.org/debian-lts-announce/2018/12/msg00006.htmlMailing ListX Refsource MLISTThird Party Advisory
usn.ubuntu.com/4160-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
security.gentoo.org/glsa/202003-57Vendor AdvisoryX Refsource GENTOOThird Party Advisory
lists.debian.org/debian-lts-announce/2021/12/msg00031.htmlMailing ListX Refsource MLISTThird Party Advisory
advisories.mageia.org/MGASA-2018-0484.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=23945REPORT
www.suse.com/support/update/announcement/2018/suse-su-20183986-1/Advisory
bugzilla.suse.com/1117107REPORT
www.suse.com/security/cve/CVE-2018-19518WEB
www.suse.com/support/update/announcement/2018/suse-su-20183988-1/Advisory
www.suse.com/support/update/announcement/2018/suse-su-20183995-1/Advisory
ubuntu.com/security/CVE-2018-19518REPORT
ubuntu.com/security/notices/USN-4160-1Advisory
www.cve.org/CVERecord?id=CVE-2018-19518REPORT
security-tracker.debian.org/tracker/CVE-2018-19518Advisory
security.alpinelinux.org/vuln/CVE-2018-19518Advisory