Format string vulnerability in the write_html function in calendar/gui/e-cal-component-memo-preview.c in Evolution Shared Memo 2.8.2.1, and possibly earlier versions, allows user-assisted remote attackers to execute arbitrary code via format specifiers in the categories of a crafted shared memo.

Ulf Harnhammar of Secunia Research discovered that Evolution did not correctly handle format strings when displaying shared memos. If a remote attacker tricked a user into viewing a specially crafted shared memo, they could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Format string problems in the Memo Viewer of evolution could be used to potentially execute code when viewing shared memos. (CVE-2007-1002)

Several remote vulnerabilities have been discovered in Evolution, a groupware suite with mail client and organizer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1002     Ulf Harnhammar discovered that a format string     vulnerability in the handling of shared calendars may     allow the execution of arbitrary code.

  - CVE-2007-3257     It was discovered that the IMAP code in the Evolution     Data Server performs insufficient sanitising of a value     later used an array index, which can lead to the     execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200706-02 (Evolution: User-assisted execution of arbitrary code)

    Ulf Harnhammar from Secunia Research has discovered a format string     error in the write_html() function in the file     calendar/gui/e-cal-component-memo-preview.c.
  Impact :

    A remote attacker could entice a user to open a specially crafted     shared memo, possibly resulting in the execution of arbitrary code with     the privileges of the user running Evolution.
  Workaround :

    There is no known workaround at this time.

Updated evolution packages that fix a format string bug are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the GNOME collection of personal information management (PIM) tools.

A format string bug was found in the way Evolution parsed the category field in a memo. If a user tried to save and then view a carefully crafted memo, arbitrary code may be executed as the user running Evolution. (CVE-2007-1002)

This flaw did not affect the versions of Evolution shipped with Red Hat Enterprise Linux 2.1, 3, or 4.

All users of Evolution should upgrade to these updated packages, which contain a backported patch which resolves this issue.

Red Hat would like to thank Ulf Harnhammar of Secunia Research for reporting this issue.

A format string error in the 'write_html()' function in calendar/gui/ e-cal-component-memo-preview.c when displaying a memo's categories can potentially be exploited to execute arbitrary code via a specially crafted shared memo containing format specifiers.

Updated packages have been patched to address this issue.

ID	Name	Product	Family	Severity
28039	Ubuntu 6.06 LTS / 6.10 : evolution vulnerability (USN-442-1)	Nessus	Ubuntu Local Security Checks	medium
27210	openSUSE 10 Security Update : evolution (evolution-3960)	Nessus	SuSE Local Security Checks	medium
25675	Debian DSA-1325-1 : evolution - several vulnerabilities	Nessus	Debian Local Security Checks	medium
25452	GLSA-200706-02 : Evolution: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
25327	RHEL 5 : evolution (RHSA-2007:0158)	Nessus	Red Hat Local Security Checks	medium
24939	Mandrake Linux Security Advisory : evolution (MDKSA-2007:070)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2007-1002

high

Tenable Plugins

medium

medium

medium

medium

medium

medium