Heap-based buffer overflow in Evolution 2.22.1 allows user-assisted remote attackers to execute arbitrary code via a long DESCRIPTION property in an iCalendar attachment, which is not properly handled during a reply in the calendar view (aka the Calendars window).

From Red Hat Security Advisory 2008:0515 :

Updated evolution28 packages that address two buffer overflow vulnerabilities are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications and personal information management (PIM) tools for the GNOME desktop environment.

A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If the Itip Formatter plug-in was disabled and a user opened a mail with a carefully crafted iCalendar attachment, arbitrary code could be executed as the user running Evolution. (CVE-2008-1108)

Note: the Itip Formatter plug-in, which allows calendar information (attachments with a MIME type of 'text/calendar') to be displayed as part of the e-mail message, is enabled by default.

A heap-based buffer overflow flaw was found in the way Evolution parsed iCalendar attachments with an overly long 'DESCRIPTION' property string. If a user responded to a carefully crafted iCalendar attachment in a particular way, arbitrary code could be executed as the user running Evolution. (CVE-2008-1109).

The particular response required to trigger this vulnerability was as follows :

1. Receive the carefully crafted iCalendar attachment. 2. Accept the associated meeting. 3. Open the calender the meeting was in. 4. Reply to the sender.

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing these issues.

All Evolution users should upgrade to these updated packages, which contain backported patches which resolves these issues.

A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If the Itip Formatter plug-in was disabled and a user opened a mail with a carefully crafted iCalendar attachment, arbitrary code could be executed as the user running Evolution. (CVE-2008-1108)

Note: the Itip Formatter plug-in, which allows calendar information (attachments with a MIME type of 'text/calendar') to be displayed as part of the e-mail message, is enabled by default.

A heap-based buffer overflow flaw was found in the way Evolution parsed iCalendar attachments with an overly long 'DESCRIPTION' property string. If a user responded to a carefully crafted iCalendar attachment in a particular way, arbitrary code could be executed as the user running Evolution. (CVE-2008-1109).

Updated evolution packages that fix two buffer overflow vulnerabilities are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications and personal information management (PIM) tools for the GNOME desktop environment.

A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If the Itip Formatter plug-in was disabled and a user opened a mail with a carefully crafted iCalendar attachment, arbitrary code could be executed as the user running Evolution. (CVE-2008-1108)

Note: the Itip Formatter plug-in, which allows calendar information (attachments with a MIME type of 'text/calendar') to be displayed as part of the e-mail message, is enabled by default.

A heap-based buffer overflow flaw was found in the way Evolution parsed iCalendar attachments with an overly long 'DESCRIPTION' property string. If a user responded to a carefully crafted iCalendar attachment in a particular way, arbitrary code could be executed as the user running Evolution. (CVE-2008-1109).

The particular response required to trigger this vulnerability was as follows :

1. Receive the carefully crafted iCalendar attachment. 2. Accept the associated meeting. 3. Open the calender the meeting was in. 4. Reply to the sender.

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing these issues.

All Evolution users should upgrade to these updated packages, which contain backported patches which resolves these issues.

Alan Rad Pop of Secunia Research discovered the following two vulnerabilities in Evolution :

Evolution did not properly validate timezone data when processing iCalendar attachments. If a user disabled the Itip Formatter plugin and viewed a crafted iCalendar attachment, an attacker could cause a denial of service or potentially execute arbitrary code with the user's privileges (CVE-2008-1108).

Evolution also did not properly validate the DESCRIPTION field when processing iCalendar attachments. If a user were tricked into accepting a crafted iCalendar attachment and replied to it from the calendar window, an attacker could cause a denial of service or potentially execute arbitrary code with the user's privileges (CVE-2008-1109).

In addition, Matej Cepl found that Evolution did not properly validate date fields when processing iCalendar attachments, which could lead to a denial of service if the user viewed a crafted iCalendar attachment with the Itip Formatter plugin disabled.

Mandriva Linux has the Itip Formatter plugin enabled by default.

The updated packages have been patched to prevent these issues.

The remote host is affected by the vulnerability described in GLSA-200806-06 (Evolution: User-assisted execution of arbitrary code)

    Alin Rad Pop (Secunia Research) reported two vulnerabilities in     Evolution:
    A boundary error exists when parsing overly long timezone strings     contained within iCalendar attachments and when the ITip formatter is     disabled (CVE-2008-1108).
    A boundary error exists when replying to an iCalendar request with an     overly long 'DESCRIPTION' property while in calendar view     (CVE-2008-1109).
  Impact :

    A remote attacker could entice a user to open a specially crafted     iCalendar attachment, resulting in the execution of arbitrary code with     the privileges of the user running Evolution.
  Workaround :

    There is no known workaround at this time.

Multiple buffer overflows have been fixed in evolution. CVE-2008-1108 / CVE-2008-1109 have been assigned to this issue.

Multiple buffer overflows have been fixed in evolution. CVE-2008-1108 and CVE-2008-1109 have been assigned to this issue.

Alin Rad Pop of Secunia Research discovered that Evolution did not properly validate timezone data when processing iCalendar attachments.
If a user disabled the ITip Formatter plugin and viewed a crafted iCalendar attachment, an attacker could cause a denial of service or possibly execute code with user privileges. Note that the ITip Formatter plugin is enabled by default in Ubuntu. (CVE-2008-1108)

Alin Rad Pop of Secunia Research discovered that Evolution did not properly validate the DESCRIPTION field when processing iCalendar attachments. If a user were tricked into accepting a crafted iCalendar attachment and replied to it from the calendar window, an attacker code cause a denial of service or execute code with user privileges.
(CVE-2008-1109)

Matej Cepl discovered that Evolution did not properly validate date fields when processing iCalendar attachments. If a user disabled the ITip Formatter plugin and viewed a crafted iCalendar attachment, an attacker could cause a denial of service. Note that the ITip Formatter plugin is enabled by default in Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix two buffer overflows in iCalendar .ics file fromat support discovered and reported by Alin Rad Pop of the Secunia Research:
CVE-2008-1108, CVE-2008-1109, SA30298 See referenced bugzilla bugs or Secunia advisories for further details:
http://secunia.com/advisories/30298 http://secunia.com/secunia_research/2008-22/advisory/ http://secunia.com/secunia_research/2008-23/advisory/

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated evolution28 packages that address two buffer overflow vulnerabilities are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications and personal information management (PIM) tools for the GNOME desktop environment.

A flaw was found in the way Evolution parsed iCalendar timezone attachment data. If the Itip Formatter plug-in was disabled and a user opened a mail with a carefully crafted iCalendar attachment, arbitrary code could be executed as the user running Evolution. (CVE-2008-1108)

Note: the Itip Formatter plug-in, which allows calendar information (attachments with a MIME type of 'text/calendar') to be displayed as part of the e-mail message, is enabled by default.

A heap-based buffer overflow flaw was found in the way Evolution parsed iCalendar attachments with an overly long 'DESCRIPTION' property string. If a user responded to a carefully crafted iCalendar attachment in a particular way, arbitrary code could be executed as the user running Evolution. (CVE-2008-1109).

The particular response required to trigger this vulnerability was as follows :

1. Receive the carefully crafted iCalendar attachment. 2. Accept the associated meeting. 3. Open the calender the meeting was in. 4. Reply to the sender.

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing these issues.

All Evolution users should upgrade to these updated packages, which contain backported patches which resolves these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0515 advisory.

    Evolution is the integrated collection of e-mail, calendaring, contact     management, communications and personal information management (PIM) tools     for the GNOME desktop environment.

    A flaw was found in the way Evolution parsed iCalendar timezone attachment     data. If the Itip Formatter plug-in was disabled and a user opened a mail     with a carefully crafted iCalendar attachment, arbitrary code could be     executed as the user running Evolution. (CVE-2008-1108)

    Note: the Itip Formatter plug-in, which allows calendar information     (attachments with a MIME type of text/calendar) to be displayed as part     of the e-mail message, is enabled by default.

    A heap-based buffer overflow flaw was found in the way Evolution parsed     iCalendar attachments with an overly long DESCRIPTION property string. If     a user responded to a carefully crafted iCalendar attachment in a     particular way, arbitrary code could be executed as the user running     Evolution. (CVE-2008-1109).

    The particular response required to trigger this vulnerability was as     follows:

    1. Receive the carefully crafted iCalendar attachment.
    2. Accept the associated meeting.
    3. Open the calender the meeting was in.
    4. Reply to the sender.

    Red Hat would like to thank Alin Rad Pop of Secunia Research for     responsibly disclosing these issues.

    All Evolution users should upgrade to these updated packages, which contain     backported patches which resolves these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
67704	Oracle Linux 4 : evolution28 (ELSA-2008-0515)	Nessus	Oracle Linux Local Security Checks	high
60418	Scientific Linux Security Update : evolution on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60416	Scientific Linux Security Update : evolution28 on SL4.6 i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43691	CentOS 5 : evolution (CESA-2008:0514)	Nessus	CentOS Local Security Checks	high
37236	Mandriva Linux Security Advisory : evolution (MDVSA-2008:111)	Nessus	Mandriva Local Security Checks	high
33203	GLSA-200806-06 : Evolution: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
33194	SuSE 10 Security Update : evolution (ZYPP Patch Number 5327)	Nessus	SuSE Local Security Checks	high
33193	openSUSE 10 Security Update : evolution (evolution-5326)	Nessus	SuSE Local Security Checks	high
33124	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : evolution vulnerabilities (USN-615-1)	Nessus	Ubuntu Local Security Checks	high
33116	Fedora 7 : evolution-2.10.3-10.fc7 (2008-5018)	Nessus	Fedora Local Security Checks	high
33115	Fedora 8 : evolution-2.12.3-5.fc8 (2008-5016)	Nessus	Fedora Local Security Checks	high
33113	Fedora 9 : evolution-2.22.2-2.fc9 (2008-4990)	Nessus	Fedora Local Security Checks	high
33110	CentOS 4 : evolution28 (CESA-2008:0515)	Nessus	CentOS Local Security Checks	high
33097	RHEL 4 : evolution28 (RHSA-2008:0515)	Nessus	Red Hat Local Security Checks	critical
33086	RHEL 5 : evolution (RHSA-2008:0514)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2008-1109

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high