CVE-2019-18849: Medium severity Tnef Project Tnef vulnerability

Q: What access or interaction is required to exploit this issue?

The attacker needs to send an e-mail containing a crafted winmail.dat attachment with the application/ms-tnef type. Exploitation requires the victim to interact with the message, as reflected by the CVSS user-interaction requirement.

Q: What is the practical impact if exploitation succeeds?

An attacker may be able to write to the victim's .ssh/authorized_keys file. This could allow unauthorized SSH key-based access to the affected user's account.

Q: Which versions should be remediated?

tnef versions before 1.4.18 are affected. Update to version 1.4.18 or a distribution-provided patched package.

Q: How can administrators check for possible compromise?

Review affected users' .ssh/authorized_keys files for unexpected or unrecognized public keys, particularly following processing of suspicious winmail.dat attachments. Remove unauthorized keys and investigate associated SSH access if any are found.

Published Nov 11, 2019

Updated

In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorizedkeys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup.

Affected Software

6 affected componentsFixes available

Tnef Project Tnef<1.4.18

Fedoraproject Fedora=30

Fedoraproject Fedora=31

Canonical Ubuntu Linux=16.04

Debian Debian Linux=8.0

debian/tnef

1.4.18-31.4.18-41.4.18-5

Remediation

Patch Available

https://github.com/verdammelt/tnef/compare/1.4.17...1.4.18

Patch Available

https://github.com/verdammelt/tnef/pull/40

Event History

Nov 11, 2019

CVE Published

via MITRE·03:21 AM

Data Sourced

via MITRE·03:21 AM

Description

Data Sourced

via NVD·04:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Feb 21, 2026

Data Sourced

via Ubuntu·12:28 AM

RemedyDescriptionSeverityAffected Software

Data Sourced

via Launchpad·12:28 AM

Description

Data Sourced

via Debian·12:29 AM

DescriptionAffected Software

Frequently Asked Questions

What access or interaction is required to exploit this issue?

The attacker needs to send an e-mail containing a crafted winmail.dat attachment with the application/ms-tnef type. Exploitation requires the victim to interact with the message, as reflected by the CVSS user-interaction requirement.

What is the practical impact if exploitation succeeds?

An attacker may be able to write to the victim's .ssh/authorized_keys file. This could allow unauthorized SSH key-based access to the affected user's account.

Which versions should be remediated?

tnef versions before 1.4.18 are affected. Update to version 1.4.18 or a distribution-provided patched package.

How can administrators check for possible compromise?

Review affected users' .ssh/authorized_keys files for unexpected or unrecognized public keys, particularly following processing of suspicious winmail.dat attachments. Remove unauthorized keys and investigate associated SSH access if any are found.

CVE-2019-18849: Medium severity Tnef Project Tnef vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What access or interaction is required to exploit this issue?

What is the practical impact if exploitation succeeds?

Which versions should be remediated?

How can administrators check for possible compromise?

Company

Resources

Contact

Frequently Asked Questions

What access or interaction is required to exploit this issue?

What is the practical impact if exploitation succeeds?

Which versions should be remediated?

How can administrators check for possible compromise?