University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2866 advisory.

  - University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products,     launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen     function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote     attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a     user of a web application) and if rsh has been replaced by a program with different argument semantics.
    For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an     IMAP server name containing a -oProxyCommand argument. (CVE-2018-19518)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17     and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC     support (uncommon), urldecode() function can be made to     access locations past the allocated memory, due to     erroneously using signed numbers as array     indexes.(CVE-2020-7067)

  - In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15     and 7.4.x below 7.4.3, when using file upload     functionality, if upload progress tracking is enabled,     but session.upload_progress.cleanup is set to 0     (disabled), and the file upload fails, the upload     procedure would try to clean up data that does not     exist and encounter null pointer dereference, which     would likely lead to a crash.(CVE-2020-7062)

  - When using certain mbstring functions to convert     multibyte encodings, in PHP versions 7.2.x below     7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is     possible to supply data that will cause function     mbfl_filt_conv_big5_wchar to read past the allocated     buffer. This may lead to information disclosure or     crash.(CVE-2020-7060)

  - When using fgetss() function to read data with     stripping tags, in PHP versions 7.2.x below 7.2.27,     7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible     to supply data that will cause this function to read     past the allocated buffer. This may lead to information     disclosure or crash.(CVE-2020-7059)

  - University of Washington IMAP Toolkit 2007f on UNIX, as     used in imap_open() in PHP and other products, launches     an rsh command (by means of the imap_rimap function in     c-client/imap4r1.c and the tcp_aopen function in     osdep/unix/tcp_unix.c) without preventing argument     injection, which might allow remote attackers to     execute arbitrary OS commands if the IMAP server name     is untrusted input (e.g., entered by a user of a web     application) and if rsh has been replaced by a program     with different argument semantics. For example, if rsh     is a link to ssh (as seen on Debian and Ubuntu     systems), then the attack can use an IMAP server name     containing a '-oProxyCommand' argument.(CVE-2018-19518)

  - ext/standard/var_unserializer.c in PHP 5.x through     7.1.24 allows attackers to cause a denial of service     (application crash) via an unserialize call for the     com, dotnet, or variant class.(CVE-2018-19396)

  - In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15     and 7.4.x below 7.4.3, when creating PHAR archive using     PharData::buildFromIterator() function, the files are     added with default permissions (0666, or all access)     even if the original files on the filesystem were with     more restrictive permissions. This may result in files     having more lax permissions than intended when such     archive is extracted.(CVE-2020-7063)

  - In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18     and 7.4.x below 7.4.6, when HTTP file uploads are     allowed, supplying overly long filenames or field names     could lead PHP engine to try to allocate oversized     memory storage, hit the memory limit and stop     processing the request, without cleaning up temporary     files created by upload request. This potentially could     lead to accumulation of uncleaned temporary files     exhausting the disk space on the target     server.(CVE-2019-11048)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15     and 7.4.x below 7.4.3, when creating PHAR archive using     PharData::buildFromIterator() function, the files are     added with default permissions (0666, or all access)     even if the original files on the filesystem were with     more restrictive permissions. This may result in files     having more lax permissions than intended when such     archive is extracted.(CVE-2020-7063)

  - In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18     and 7.4.x below 7.4.6, when HTTP file uploads are     allowed, supplying overly long filenames or field names     could lead PHP engine to try to allocate oversized     memory storage, hit the memory limit and stop     processing the request, without cleaning up temporary     files created by upload request. This potentially could     lead to accumulation of uncleaned temporary files     exhausting the disk space on the target     server.(CVE-2019-11048)

  - University of Washington IMAP Toolkit 2007f on UNIX, as     used in imap_open() in PHP and other products, launches     an rsh command (by means of the imap_rimap function in     c-client/imap4r1.c and the tcp_aopen function in     osdep/unix/tcp_unix.c) without preventing argument     injection, which might allow remote attackers to     execute arbitrary OS commands if the IMAP server name     is untrusted input (e.g., entered by a user of a web     application) and if rsh has been replaced by a program     with different argument semantics. For example, if rsh     is a link to ssh (as seen on Debian and Ubuntu     systems), then the attack can use an IMAP server name     containing a '-oProxyCommand' argument.(CVE-2018-19518)

  - ext/standard/var_unserializer.c in PHP 5.x through     7.1.24 allows attackers to cause a denial of service     (application crash) via an unserialize call for the     com, dotnet, or variant class.(CVE-2018-19396)

  - When using certain mbstring functions to convert     multibyte encodings, in PHP versions 7.2.x below     7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is     possible to supply data that will cause function     mbfl_filt_conv_big5_wchar to read past the allocated     buffer. This may lead to information disclosure or     crash.(CVE-2020-7060)

  - When using fgetss() function to read data with     stripping tags, in PHP versions 7.2.x below 7.2.27,     7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible     to supply data that will cause this function to read     past the allocated buffer. This may lead to information     disclosure or crash.(CVE-2020-7059)

  - In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15     and 7.4.x below 7.4.3, when using file upload     functionality, if upload progress tracking is enabled,     but session.upload_progress.cleanup is set to 0     (disabled), and the file upload fails, the upload     procedure would try to clean up data that does not     exist and encounter null pointer dereference, which     would likely lead to a crash.(CVE-2020-7062)

  - In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17     and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC     support (uncommon), urldecode() function can be made to     access locations past the allocated memory, due to     erroneously using signed numbers as array     indexes.(CVE-2020-7067)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202003-57 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary shell commands, cause a       Denial of Service condition or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

It was discovered that UW IMAP incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.33. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary command injection vulnerability exists in   the imap_open function due to improper filters for mailbox names   prior to passing them to rsh or ssh commands. An authenticated,   remote attacker can exploit this by sending a specially crafted IMAP   server name to cause the execution of arbitrary commands on the   target system. (CVE-2018-19518)

  - A heap buffer over-read exists in the phar_parse_pharfile function.
  An unauthenticated, remote attacker can exploit this to read   allocated or unallocated memory past the actual data when trying to   parse a .phar file. (CVE-2018-20783)

A vulnerability was discovered in uw-imap, the University of Washington IMAP Toolkit, that might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics.

This update disables access to IMAP mailboxes through running imapd over rsh, and therefore ssh for users of the client application. Code which uses the library can still enable it with tcp_parameters() after making sure that the IMAP server name is sanitized.

For Debian 8 'Jessie', this problem has been fixed in version 8:2007f~dfsg-4+deb8u1.

We recommend that you upgrade your uw-imap packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.39, 7.0.x prior to 7.0.33, 7.1.x prior to 7.1.25, 7.2.x prior to 7.2.13 or 7.3.x prior to 7.3.0. It is, therefore, affected by multiple vulnerabilities:

 - An arbitrary command injection vulnerability exists in the imap_open function due to improper filters for mailbox names prior to passing them to rsh or ssh commands. An authenticated, remote attacker can exploit this by sending a specially crafted IMAP server name to cause the execution of arbitrary commands on the target system. (CVE-2018-19518)

 - A heap buffer over-read exists in the phar_parse_pharfile function. An unauthenticated, remote attacker can exploit this to read allocated or unallocated memory past the actual data when trying to parse a .phar file. (CVE-2018-20783)

 - A NULL pointer dereference on Windows. An unauthenticated, remote attacker can exploit this to crash the application and perform a denial of service. (CVE-2018-19395)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.(CVE-2018-19935)

University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a '-oProxyCommand' argument.(CVE-2018-19518)

**PHP version 7.2.13** (06 Dec 2018)

**ftp:**

  - Fixed bug php#77151 (ftp_close(): SSL_read on shutdown).
    (Remi)

**CLI:**

  - Fixed bug php#77111 (php-win.exe corrupts unicode     symbols from cli parameters). (Anatol)

**Fileinfo:**

  - Fixed bug php#77095 (slowness regression in 7.2/7.3     (compared to 7.1)). (Anatol)

**iconv:**

  - Fixed bug php#77147 (Fixing 60494 ignored     ICONV_MIME_DECODE_CONTINUE_ON_ERROR). (cmb)

**Core:**

  - Fixed bug php#77231 (Segfault when using     convert.quoted-printable-encode filter). (Stas)

**IMAP:**

  - Fixed bug php#77153 (imap_open allows to run arbitrary     shell commands via mailbox parameter). (Stas)

**ODBC:**

  - Fixed bug php#77079 (odbc_fetch_object has incorrect     type signature). (Jon Allen)

**Opcache:**

  - Fixed bug php#77058 (Type inference in opcache causes     side effects). (Nikita)

  - Fixed bug php#77092 (array_diff_key() - segmentation     fault). (Nikita)

**Phar:**

  - Fixed bug php#77022 (PharData always creates new files     with mode 0666). (Stas)

  - Fixed bug php#77143 (Heap Buffer Overflow (READ: 4) in     phar_parse_pharfile). (Stas)

**PGSQL:**

  - Fixed bug php#77047 (pg_convert has a broken regex for     the 'TIME WITHOUT TIMEZONE' data type). (Andy Gajetzki)

**SOAP:**

  - Fixed bug php#50675 (SoapClient can't handle object     references correctly). (Cameron Porter)

  - Fixed bug php#76348 (WSDL_CACHE_MEMORY causes     Segmentation fault). (cmb)

  - Fixed bug php#77141 (Signedness issue in SOAP when     precision=-1). (cmb)

**Sockets:**

  - Fixed bug php#67619 (Validate length on socket_write).
    (thiagooak)

----

**From upstream**

**IMAP**

  - Fix php#77020 NULL pointer dereference in imap_mail     CVE-2018-19935

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issues :

Security issue fixed :

CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

Security issue fixed :

CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.2.x prior to 7.2.13. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary command injection vulnerability exists in the   imap_open function due to improper filters for mailbox names prior   to passing them to rsh or ssh commands. An authenticated, remote   attacker can exploit this by sending a specially crafted IMAP server   name to cause the execution of arbitrary commands on the target   system. (CVE-2018-19518)

  - A heap buffer over-read exists in the phar_parse_pharfile function.
  An unauthenticated, remote attacker can exploit this to read   allocated or unallocated memory past the actual data when trying to   parse a .phar file. (CVE-2018-20783)

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.25. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary command injection vulnerability exists in the   imap_open function due to improper filters for mailbox names prior   to passing them to rsh or ssh commands. An authenticated, remote   attacker can exploit this by sending a specially crafted IMAP server   name to cause the execution of arbitrary commands on the target   system. (CVE-2018-19518)

  - A heap buffer over-read exists in the phar_parse_pharfile function.
  An unauthenticated, remote attacker can exploit this to read   allocated or unallocated memory past the actual data when trying to   parse a .phar file. (CVE-2018-20783)

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.39. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary command injection vulnerability exists in the   imap_open function due to improper filters for mailbox names prior   to passing them to rsh or ssh commands. An authenticated, remote   attacker can exploit this by sending a specially crafted IMAP server   name to cause the execution of arbitrary commands on the target   system. (CVE-2018-19518)

  - A denial of service (DoS) vulnerability exists in   ext/imap/php_imap.c. An unauthenticated, remote attacker can   exploit this issue, via an empty string in the message argument   to the imap_mail function, to cause the application to stop   responding. (CVE-2018-19935)

  - A heap buffer over-read exists in the phar_parse_pharfile function.
  An unauthenticated, remote attacker can exploit this to read   allocated or unallocated memory past the actual data when trying to   parse a .phar file. (CVE-2018-20783)

Vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. Note that this update includes a change to the default behavior for IMAP connections. See below for details.

CVE-2018-19518

An argument injection vulnerability in imap_open() may allow a remote attacker to execute arbitrary OS commands on the IMAP server.

The fix for the CVE-2018-19518 vulnerability included this additional note from the upstream developers :

Starting with 5.6.38, rsh/ssh logins are disabled by default. Use imap.enable_insecure_rsh if you want to enable them. Note that the IMAP library does not filter mailbox names before passing them to rsh/ssh command, thus passing untrusted data to this function with rsh/ssh enabled is insecure.

CVE-2018-19935

A NULL pointer dereference leads to an application crash and a denial of service via an empty string in the message argument to the imap_mail function of ext/imap/php_imap.c.

For Debian 8 'Jessie', these problems have been fixed in version 5.6.39+dfsg-0+deb8u1.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

Security issue fixed :

  - CVE-2018-19518: Fixed imap_open script injection flaw     (bsc#1117107).

This update was imported from the SUSE:SLE-12:Update update project.

This update for php5 fixes the following issues :

Security issue fixed :

  - CVE-2018-19518: Fixed imap_open script injection flaw     (bsc#1117107).

This update was imported from the SUSE:SLE-12:Update update project.

Multiple security issues were found in PHP, a widely-used open source general purpose scripting language: The EXIF module was susceptible to denial of service/information disclosure when parsing malformed images, the Apache module allowed cross-site-scripting via the body of a 'Transfer-Encoding: chunked' request and the IMAP extension performed insufficient input validation which can result in the execution of arbitrary shell commands in the imap_open() function and denial of service in the imap_mail() function.

This update for php53 fixes the following issues :

Security issue fixed :

CVE-2018-19518: Fixed imap_open script injection flaw (bsc#1117107).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.3.0 [alpha|beta] prior to 7.3.0. It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary command injection vulnerability exists in   the imap_open function due to improper filters for mailbox names   prior to passing them to rsh or ssh commands. An authenticated,   remote attacker can exploit this by sending a specially crafted IMAP   server name to cause the execution of arbitrary commands on the   target system. (CVE-2018-19518)

  - A denial of service vulnerability exists in the imap_mail function   due to improper data validation. An unauthenticated, remote attacker   can exploit this via an empty string in the message argument to the   imap_mail function to cause the application to stop responding.
  (CVE-2018-19935)

  - A heap buffer over-read exists in the phar_parse_pharfile function.
  An unauthenticated, remote attacker can exploit this to read   allocated or unallocated memory past the actual data when trying to   parse a .phar file. (CVE-2018-20783)

ID	Name	Product	Family	Severity
156391	Debian DLA-2866-1 : uw-imap - LTS security update	Nessus	Debian Local Security Checks	high
139998	EulerOS Virtualization for ARM 64 3.0.6.0 : php (EulerOS-SA-2020-1895)	Nessus	Huawei Local Security Checks	critical
139151	EulerOS 2.0 SP8 : php (EulerOS-SA-2020-1821)	Nessus	Huawei Local Security Checks	critical
134965	GLSA-202003-57 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
130149	Ubuntu 16.04 LTS / 18.04 LTS : UW IMAP vulnerability (USN-4160-1)	Nessus	Ubuntu Local Security Checks	high
122821	PHP 7.0.x < 7.0.33 Multiple vulnerabilities	Nessus	CGI abuses	high
122548	Debian DLA-1700-1 : uw-imap security update	Nessus	Debian Local Security Checks	high
98884	PHP 7.3.x < 7.3.0 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	high
98883	PHP 7.2.x < 7.2.13 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	high
98882	PHP 7.1.x < 7.1.25 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	high
98881	PHP 7.0.x < 7.0.33 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	high
98880	PHP 5.6.x < 5.6.39 Multiple vulnerabilities	Web App Scanning	Component Vulnerability	high
121132	Amazon Linux AMI : php56 / php70,php71,php72 (ALAS-2019-1147)	Nessus	Amazon Linux Local Security Checks	high
120854	Fedora 28 : php (2018-dfe1f0bac6)	Nessus	Fedora Local Security Checks	high
120566	Fedora 29 : php (2018-7ebfe1e6f2)	Nessus	Fedora Local Security Checks	high
120177	SUSE SLES12 Security Update : Recommended update for php5 (SUSE-SU-2018:3995-1)	Nessus	SuSE Local Security Checks	high
120176	SUSE SLES12 Security Update : Recommended update for php7 (SUSE-SU-2018:3988-1)	Nessus	SuSE Local Security Checks	high
119766	PHP 7.2.x < 7.2.13 Multiple vulnerabilities	Nessus	CGI abuses	high
119765	PHP 7.1.x < 7.1.25 Multiple vulnerabilities	Nessus	CGI abuses	high
119764	PHP 5.6.x < 5.6.39 Multiple vulnerabilities	Nessus	CGI abuses	high
119695	Debian DLA-1608-1 : php5 security update	Nessus	Debian Local Security Checks	high
119570	openSUSE Security Update : php7 (openSUSE-2018-1507)	Nessus	SuSE Local Security Checks	high
119569	openSUSE Security Update : php5 (openSUSE-2018-1506)	Nessus	SuSE Local Security Checks	high
119561	Debian DSA-4353-1 : php7.0 - security update	Nessus	Debian Local Security Checks	high
119455	SUSE SLES11 Security Update : Recommended update for php53 (SUSE-SU-2018:3986-1)	Nessus	SuSE Local Security Checks	high
111217	PHP 7.3.0 [alpha\|beta] < 7.3.0 Multiple vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2018-19518

high

Tenable Plugins

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high