Security update for mgetty SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2979-1 Final 1 1 2018-10-02T15:51:02Z current 2018-10-02T15:51:02Z 2018-10-02T15:51:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mgetty This update for mgetty fixes the following security issues: - CVE-2018-16741: The function do_activate() did not properly sanitize shell metacharacters to prevent command injection (bsc#1108752) - CVE-2018-16745: The mail_to parameter was not sanitized, leading to a buffer overflow if long untrusted input reached it (bsc#1108756) - CVE-2018-16744: The mail_to parameter was not sanitized, leading to command injection if untrusted input reached reach it (bsc#1108757) - CVE-2018-16742: Prevent stack-based buffer overflow that could have been triggered via a command-line parameter (bsc#1108762) - CVE-2018-16743: The command-line parameter username wsa passed unsanitized to strcpy(), which could have caused a stack-based buffer overflow (bsc#1108761) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP3-2018-2122,SUSE-SLE-SERVER-12-SP3-2018-2122 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182979-1/ Link for SUSE-SU-2018:2979-1 https://lists.suse.com/pipermail/sle-security-updates/2018-October/004636.html E-Mail link for SUSE-SU-2018:2979-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1108752 SUSE Bug 1108752 https://bugzilla.suse.com/1108756 SUSE Bug 1108756 https://bugzilla.suse.com/1108757 SUSE Bug 1108757 https://bugzilla.suse.com/1108761 SUSE Bug 1108761 https://bugzilla.suse.com/1108762 SUSE Bug 1108762 https://www.suse.com/security/cve/CVE-2018-16741/ SUSE CVE CVE-2018-16741 page https://www.suse.com/security/cve/CVE-2018-16742/ SUSE CVE CVE-2018-16742 page https://www.suse.com/security/cve/CVE-2018-16743/ SUSE CVE CVE-2018-16743 page https://www.suse.com/security/cve/CVE-2018-16744/ SUSE CVE CVE-2018-16744 page https://www.suse.com/security/cve/CVE-2018-16745/ SUSE CVE CVE-2018-16745 page SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 g3utils-1.1.36-58.3.1 mgetty-1.1.36-58.3.1 g3utils-1.1.36-58.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 mgetty-1.1.36-58.3.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 g3utils-1.1.36-58.3.1 as a component of SUSE Linux Enterprise Server 12 SP3 mgetty-1.1.36-58.3.1 as a component of SUSE Linux Enterprise Server 12 SP3 g3utils-1.1.36-58.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 mgetty-1.1.36-58.3.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command. CVE-2018-16741 SUSE Linux Enterprise Desktop 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Desktop 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:mgetty-1.1.36-58.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182979-1/ https://www.suse.com/security/cve/CVE-2018-16741.html CVE-2018-16741 https://bugzilla.suse.com/1108752 SUSE Bug 1108752 An issue was discovered in mgetty before 1.2.1. In contrib/scrts.c, a stack-based buffer overflow can be triggered via a command-line parameter. CVE-2018-16742 SUSE Linux Enterprise Desktop 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Desktop 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:mgetty-1.1.36-58.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182979-1/ https://www.suse.com/security/cve/CVE-2018-16742.html CVE-2018-16742 https://bugzilla.suse.com/1108762 SUSE Bug 1108762 https://bugzilla.suse.com/1121954 SUSE Bug 1121954 An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy(), which can cause a stack-based buffer overflow. CVE-2018-16743 SUSE Linux Enterprise Desktop 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Desktop 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:mgetty-1.1.36-58.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182979-1/ https://www.suse.com/security/cve/CVE-2018-16743.html CVE-2018-16743 https://bugzilla.suse.com/1108761 SUSE Bug 1108761 https://bugzilla.suse.com/1121954 SUSE Bug 1121954 An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow for command injection if untrusted input can reach it, because popen is used. CVE-2018-16744 SUSE Linux Enterprise Desktop 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Desktop 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:mgetty-1.1.36-58.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182979-1/ https://www.suse.com/security/cve/CVE-2018-16744.html CVE-2018-16744 https://bugzilla.suse.com/1108757 SUSE Bug 1108757 An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow a buffer overflow if long untrusted input can reach it. CVE-2018-16745 SUSE Linux Enterprise Desktop 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Desktop 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server 12 SP3:mgetty-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:g3utils-1.1.36-58.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:mgetty-1.1.36-58.3.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182979-1/ https://www.suse.com/security/cve/CVE-2018-16745.html CVE-2018-16745 https://bugzilla.suse.com/1108756 SUSE Bug 1108756 https://bugzilla.suse.com/1121954 SUSE Bug 1121954