CVE-2018-16741
UnknownEPSS 1.32%
Last modified
CVE-2018-16741 is a vulnerability of currently unknown severity. An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. EPSS estimates a 1.32% chance of exploitation in the next 30 days.
Description
An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mgetty Project | Mgetty | < 1.2.1 |
| Debian | Debian Linux | 8.0 |
| Debian | Debian Linux | 9.0 |
References
- https://lists.debian.org/debian-lts-announce/2018/09/msg00012.htmlMailing List, Third Party Advisory
- https://www.debian.org/security/2018/dsa-4291Third Party Advisory
- https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgettyExploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/09/msg00012.htmlMailing List, Third Party Advisory
- https://www.debian.org/security/2018/dsa-4291Third Party Advisory
- https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgettyExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-16741?
An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.
How severe is CVE-2018-16741?
Severity scoring for CVE-2018-16741 is pending analysis. The EPSS model estimates a 1.32% probability of exploitation in the next 30 days.
How do I fix CVE-2018-16741?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2018-16741?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST