UBUNTU-CVE-2018-19518

    Dashboard / Vulnerabilities / UBUNTU-CVE-2018-19518

    UBUNTU-CVE-2018-19518

    Published: 25 Nov 2018Last Modified: 22 Apr 2026
    Upstream:
    CVE-2018-19518
    Aliases:
    USN-4160-1

    Summary:

    Details: University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

    References: https://ubuntu.com/security/CVE-2018-19518, https://www.openwall.com/lists/oss-security/2018/11/22/3, https://antichat.com/threads/463395/#post-4254681, https://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.php, https://ubuntu.com/security/notices/USN-4160-1, https://www.cve.org/CVERecord?id=CVE-2018-19518

    Affected packages

    Package

    Name: php-imap

    Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=trusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.4.6-0ubuntu5.1

    Affected versions

    5.4.6-0ubuntu3
    5.4.6-0ubuntu5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High