Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers.

Ulf Harnhammar discovered several format string vulnerabilities in Evolution, a free groupware suite, that could lead to crashes of the application or the execution of arbitrary code.

Updated evolution packages that fix a format string issue are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Evolution is the GNOME collection of personal information management (PIM) tools.

A format string bug was found in Evolution. If a user tries to save a carefully crafted meeting or appointment, arbitrary code may be executed as the user running Evolution. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2550 to this issue.

Additionally, several other format string bugs were found in Evolution. If a user views a malicious vCard, connects to a malicious LDAP server, or displays a task list from a malicious remote server, arbitrary code may be executed as the user running Evolution. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2549 to this issue. Please note that this issue only affects Red Hat Enterprise Linux 4.

All users of Evolution should upgrade to these updated packages, which contain a backported patch which resolves this issue.

A SITIC Vulnerability Advisory reports :

Evolution suffers from several format string bugs when handling data from remote sources. These bugs lead to crashes or the execution of arbitrary assembly language code.

- The first format string bug occurs when viewing the full vCard data attached to an e-mail message.

- The second format string bug occurs when displaying contact data from remote LDAP servers.

- The third format string bug occurs when displaying task list data from remote servers.

- The fourth, and least serious, format string bug occurs when the user goes to the Calendars tab to save task list data that is vulnerable to problem 3 above. Other calendar entries that do not come from task lists are also affected.

Multiple format string vulnerabilities in Evolution 1.5 through 2.3.6.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) full vCard data, (2) contact data from remote LDAP servers, or (3) task list data from remote servers. (CVE-2005-2549)

A format string vulnerability in Evolution 1.4 through 2.3.6.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the calendar entries such as task lists, which are not properly handled when the user selects the Calendars tab. (CVE-2005-2550)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:267 advisory.

  - security flaw (CVE-2005-2549, CVE-2005-2550)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200508-12 (Evolution: Format string vulnerabilities)

    Ulf Harnhammar discovered that Evolution is vulnerable to format     string bugs when viewing attached vCards and when displaying contact     information from remote LDAP servers or task list data from remote     servers (CAN-2005-2549). He also discovered that Evolution fails to     handle special calendar entries if the user switches to the Calendars     tab (CAN-2005-2550).
  Impact :

    An attacker could attach specially crafted vCards to emails or     setup malicious LDAP servers or calendar entries which would trigger     the format string vulnerabilities when viewed or accessed from     Evolution. This could potentially result in the execution of arbitrary     code with the rights of the user running Evolution.
  Workaround :

    There is no known workaround at this time.

Fix for SITIC Vulnerability Advisory SA05-001

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of the Ximian Evolution email client that does not properly parse user-supplied data.  A remote attacker can craft an email message such that, upon opening, Evolution crashes or executes arbitrary code.

ID	Name	Product	Family	Severity
22558	Debian DSA-1016-1 : evolution - format string vulnerabilities	Nessus	Debian Local Security Checks	high
21922	CentOS 3 / 4 : Evolution (CESA-2005:267)	Nessus	CentOS Local Security Checks	high
21526	FreeBSD : evolution -- remote format string vulnerabilities (e5afdf63-1746-11da-978e-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
19898	Mandrake Linux Security Advisory : evolution (MDKSA-2005:141)	Nessus	Mandriva Local Security Checks	high
19542	RHEL 4 : Evolution (RHSA-2005:267)	Nessus	Red Hat Local Security Checks	critical
19485	GLSA-200508-12 : Evolution: Format string vulnerabilities	Nessus	Gentoo Local Security Checks	high
19437	Fedora Core 4 : evolution-2.2.3-2.fc4 (2005-743)	Nessus	Fedora Local Security Checks	high
3161	Ximian Evolution < 2.3.7 Content-Parsing Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	medium

Detections

Analytics

CVE-2005-2549

critical

Tenable Plugins

high

high

high

high

critical

high

high

medium