HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, which is mishandled in FaxModem::writeECMData() in the faxd/CopyQuality.c++ file.

A malicious sender that sets both JPEG and MH,MR,MMR or JBIG in the same DCS signal or sends a large JPEG page could lead to remote code execution.

This update for hylafax+ fixes the following issues :

Security issues fixed in 5.6.1 :

  - CVE-2018-17141: multiple vulnerabilities affecting fax     page reception in JPEG format Specially crafted input     may have allowed remote execution of arbitrary code     (boo#1109084)

Additionally, this update also contains all upstream corrections and bugfixes in the 5.6.1 version, including :

  - fix RFC2047 encoding by notify

  - add jobcontrol PageSize feature

  - don't wait forever after +FRH:3

  - fix faxmail transition between a message and external     types

  - avoid pagehandling from introducing some unnecessary EOM     signals

  - improve proxy connection error handling and logging

  - add initial ModemGroup limits feature

  - pass the user's uid onto the session log file for sent     faxes

  - improve job waits to minimize triggers

  - add ProxyTaglineFormat and ProxyTSI features

HylaFAX+ 5.6.1 ==============

  - address CVE-2018-17141, fixes JPEG vulnerabilities (18     Sep 2018)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Luis Merino, Markus Vervier and Eric Sesterhenn discovered that missing input sanitising in the Hylafax fax software could potentially result in the execution of arbitrary code via a malformed fax message.

For Debian 8 'Jessie', this problem has been fixed in version 3:6.0.6-6+deb8u1.

We recommend that you upgrade your hylafax packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Luis Merino, Markus Vervier and Eric Sesterhenn discovered that missing input sanitising in the Hylafax fax software could potentially result in the execution of arbitrary code via a malformed fax message.

ID	Name	Product	Family	Severity
124608	FreeBSD : comms/hylafax -- Malformed fax sender remote code execution in JPEG support (3df5a920-6edc-11e9-a44b-0050562a4d7b)	Nessus	FreeBSD Local Security Checks	critical
123309	openSUSE Security Update : hylafax+ (openSUSE-2019-711)	Nessus	SuSE Local Security Checks	critical
120718	Fedora 29 : hylafax+ (2018-b21354b100)	Nessus	Fedora Local Security Checks	critical
120350	Fedora 28 : hylafax+ (2018-37a27807e0)	Nessus	Fedora Local Security Checks	critical
117716	Fedora 27 : hylafax+ (2018-11b966722a)	Nessus	Fedora Local Security Checks	critical
117658	openSUSE Security Update : hylafax+ (openSUSE-2018-1027)	Nessus	SuSE Local Security Checks	critical
117642	Debian DLA-1515-1 : hylafax security update	Nessus	Debian Local Security Checks	critical
117621	Debian DSA-4298-1 : hylafax - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-17141

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical