Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 561
Alerts This Week
Warning Icon 1 561

SUSE: 2018:2979-1 Important: Mgetty Command Injection Risks

suse
Calendar Grey October 2, 2018
Scroller Suse Esm H88
SUSE Security Patch for mgetty resolves 5 major vulnerabilities. Update your systems immediately to safeguard against urgent risks.
An update that fixes 5 vulnerabilities is now available

Summary

This update for mgetty fixes the following security issues: - CVE-2018-16741: The function do_activate() did not properly sanitize shell metacharacters to prevent command injection (bsc#1108752) - CVE-2018-16745: The mail_to parameter was not sanitized, leading to a buffer overflow if long untrusted input reached it (bsc#1108756) - CVE-2018-16744: The mail_to parameter was not sanitized, leading to command injection if untrusted input reached reach it (bsc#1108757) - CVE-2018-16742: Prevent stack-based buffer overflow that could have been triggered via a command-line parameter (bsc#1108762) - CVE-2018-16743: The command-line parameter username wsa passed unsanitized to strcpy(), which could have caused a stack-based buffer overflow (bsc#1108761) Patch Instructions:

Topics%20covered

Topics Covered

security advisory buffer overflow important SUSE mgetty command injection

References

#1108752 #1108756 #1108757 #1108761 #1108762

Cross- CVE-2018-16741 CVE-2018-16742 CVE-2018-16743

CVE-2018-16744 CVE-2018-16745

Affected Products:

SUSE Linux Enterprise Server 12-SP3

SUSE Linux Enterprise Desktop 12-SP3

https://www.suse.com/security/cve/CVE-2018-16741.html

https://www.suse.com/security/cve/CVE-2018-16742.html

https://www.suse.com/security/cve/CVE-2018-16743.html

https://www.suse.com/security/cve/CVE-2018-16744.html

https://www.suse.com/security/cve/CVE-2018-16745.html

https://bugzilla.suse.com/1108752

https://bugzilla.suse.com/1108756

https://bugzilla.suse.com/1108757

https://bugzilla.suse.com/1108761

https://bugzilla.suse.com/1108762

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2018:2979-1
Rating: important

Topics%20covered

Topics Covered

security advisory buffer overflow important SUSE mgetty command injection

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.