In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup.

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2748 advisory.

  - In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an     e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer     over-read involving strdup. (CVE-2019-18849)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4524-1 advisory.

    Paul Dreik discovered that TNEF incorrectly handled filenames. If a user were tricked into opening a     specially crafted email attachment, an attacker could possibly use this issue to write arbitrary files to     the filesystem or cause TNEF crash, resulting in a denial of service. (CVE-2019-18849)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

tnef release 1.4.18. ==================== Security release to resolve [CVE-2019-18849](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-20 19-18849) in which it may be possible to attack via a crafted email message extracted via tnef.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In tnef, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup.

For Debian 8 'Jessie', this problem has been fixed in version 1.4.9-1+deb8u4.

We recommend that you upgrade your tnef packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
152773	Debian DLA-2748-1 : tnef - LTS security update	Nessus	Debian Local Security Checks	medium
140719	Ubuntu 16.04 LTS : TNEF vulnerabilities (USN-4524-1)	Nessus	Ubuntu Local Security Checks	medium
131712	Fedora 31 : tnef (2019-815807c020)	Nessus	Fedora Local Security Checks	high
131711	Fedora 30 : tnef (2019-5f14b810f8)	Nessus	Fedora Local Security Checks	high
131430	Debian DLA-2005-1 : tnef security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-18849

medium

Tenable Plugins

medium

medium

high

high

medium