Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2018-16741: mgetty may run unintended commands when activating fax jobs
CVE-2018-16741 · published 8 years ago
Summary
The mgetty program (versions before 1.2.1) does not filter special characters in the fax activation command. An attacker could insert characters like && or > into a fax job file and cause the system to execute arbitrary commands. Update mgetty to version 1.2.1 or later, or apply a patch that correctly sanitizes input.
What to do
- Update mgetty_project mgetty to version 1.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mgetty_project | mgetty |
< 1.2.1 cpe:2.3:a:mgetty_project:mgetty:*:*:*:*:*:*:*:* |
| debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use ...
An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the "faxq-helper activate <jobid>" command.
References
- https://lists.debian.org/debian-lts-announce/2018/09/msg00012.html Mailing List Third Party Advisory
- https://www.debian.org/security/2018/dsa-4291 Third Party Advisory
- https://www.x41-dsec.de/lab/advisories/x41-2018-007-mgetty Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
Timeline
Published13 Sep 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-16741 · NVD
Track software like this
Free during beta