The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.

From Red Hat Security Advisory 2009:0358 :

Updated evolution packages that fixes multiple security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications, and personal information management (PIM) tools for the GNOME desktop environment.

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

An integer overflow flaw which could cause heap-based buffer overflow was found in the Base64 encoding routine used by evolution. This could cause evolution to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of evolution must be restarted for the update to take effect.

From Red Hat Security Advisory 2009:0355 :

Updated evolution and evolution-data-server packages that fixes multiple security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications, and personal information management (PIM) tools for the GNOME desktop environment.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task and calendar information. Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by evolution and evolution-data-server. This could cause evolution, or an application using evolution-data-server, to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution and evolution-data-server are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of evolution and evolution-data-server must be restarted for the update to take effect.

From Red Hat Security Advisory 2009:0354 :

Updated evolution-data-server and evolution28-evolution-data-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task, and calendar information.
Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that Evolution Data Server did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause an application using Evolution Data Server to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by Evolution Data Server. This could cause an application using Evolution Data Server to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution-data-server and evolution28-evolution-data-server are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Evolution Data Server and applications using it (such as Evolution) must be restarted for the update to take effect.

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

An integer overflow flaw which could cause heap-based buffer overflow was found in the Base64 encoding routine used by evolution. This could cause evolution to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All running instances of evolution must be restarted for the update to take effect.

Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that Evolution Data Server did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause an application using Evolution Data Server to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by Evolution Data Server. This could cause an application using Evolution Data Server to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All running instances of Evolution Data Server and applications using it (such as Evolution) must be restarted for the update to take effect.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task and calendar information. Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by evolution and evolution-data-server. This could cause evolution, or an application using evolution-data-server, to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All running instances of evolution and evolution-data-server must be restarted for the update to take effect.

camel's NTLM SASL authentication mechanism as used by evolution did not properly validate server's challenge packets. (CVE-2009-0582)

camel's NTLM SASL authentication mechanism as used by evolution did not properly validate server's challenge packets. (CVE-2009-0582)

This update also includes the following non-security fixes :

  - Fixes a critical crasher in mailer component.

  - Fixes creation of recurrence monthly items in GroupWise.

  - Includes fixes for some usability issues.

camel's NTLM SASL authentication mechanism as used by evolution did not properly validate server's challenge packets (CVE-2009-0582). 

This update also includes the following non-security fixes :

  - Fixes a critical crasher in mailer component. 

  - Fixes creation of recurrence monthly items in GroupWise. 

  - Includes fixes for some usability issues.

camel's NTLM SASL authentication mechanism as used by evolution did not properly validate server's challenge packets (CVE-2009-0582).

Several vulnerabilities have been found in evolution-data-server, the database backend server for the evolution groupware suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0587     It was discovered that evolution-data-server is prone to     integer overflows triggered by large base64 strings.

  - CVE-2009-0547     Joachim Breitner discovered that S/MIME signatures are     not verified properly, which can lead to spoofing     attacks.

  - CVE-2009-0582     It was discovered that NTLM authentication challenge     packets are not validated properly when using the NTLM     authentication method, which could lead to an     information disclosure or a denial of service.

Updated evolution and evolution-data-server packages that fixes multiple security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications, and personal information management (PIM) tools for the GNOME desktop environment.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task and calendar information. Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by evolution and evolution-data-server. This could cause evolution, or an application using evolution-data-server, to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution and evolution-data-server are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of evolution and evolution-data-server must be restarted for the update to take effect.

Updated evolution-data-server and evolution28-evolution-data-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task, and calendar information.
Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that Evolution Data Server did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause an application using Evolution Data Server to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by Evolution Data Server. This could cause an application using Evolution Data Server to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution-data-server and evolution28-evolution-data-server are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Evolution Data Server and applications using it (such as Evolution) must be restarted for the update to take effect.

This update fixes two security issues: Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user.
(CVE-2009-0547) It was discovered that Evolution Data Server did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause an application using Evolution Data Server to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A wrong handling of signed Secure/Multipurpose Internet Mail Extensions (S/MIME) e-mail messages enables attackers to spoof its signatures by modifying the latter copy (CVE-2009-0547).

Crafted authentication challange packets (NT Lan Manager type 2) sent by a malicious remote mail server enables remote attackers either to cause denial of service and to read information from the process memory of the client (CVE-2009-0582).

Multiple integer overflows in Base64 encoding functions enables attackers either to cause denial of service and to execute arbitrary code (CVE-2009-0587).

This update provides fixes for those vulnerabilities.

Update :

evolution-data-server packages from Mandriva Linux distributions 2008.1 and 2009.0 are not affected by CVE-2009-0587.

Updated evolution packages that fixes multiple security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications, and personal information management (PIM) tools for the GNOME desktop environment.

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

An integer overflow flaw which could cause heap-based buffer overflow was found in the Base64 encoding routine used by evolution. This could cause evolution to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of evolution must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0355 advisory.

    Evolution is the integrated collection of e-mail, calendaring, contact     management, communications, and personal information management (PIM) tools     for the GNOME desktop environment.

    Evolution Data Server provides a unified back-end for applications which     interact with contacts, task and calendar information. Evolution Data     Server was originally developed as a back-end for Evolution, but is now     used by multiple other applications.

    Evolution did not properly check the Secure/Multipurpose Internet Mail     Extensions (S/MIME) signatures used for public key encryption and signing     of e-mail messages. An attacker could use this flaw to spoof a signature by     modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

    It was discovered that evolution did not properly validate NTLM (NT LAN     Manager) authentication challenge packets. A malicious server using NTLM     authentication could cause evolution to disclose portions of its memory or     crash during user authentication. (CVE-2009-0582)

    Multiple integer overflow flaws which could cause heap-based buffer     overflows were found in the Base64 encoding routines used by evolution and     evolution-data-server. This could cause evolution, or an application using     evolution-data-server, to crash, or, possibly, execute an arbitrary code     when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

    All users of evolution and evolution-data-server are advised to upgrade to     these updated packages, which contain backported patches to correct these     issues. All running instances of evolution and evolution-data-server must     be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
67827	Oracle Linux 3 : evolution (ELSA-2009-0358)	Nessus	Oracle Linux Local Security Checks	high
67826	Oracle Linux 4 : evolution / evolution-data-server (ELSA-2009-0355)	Nessus	Oracle Linux Local Security Checks	high
67825	Oracle Linux 4 / 5 : evolution-data-server (ELSA-2009-0354)	Nessus	Oracle Linux Local Security Checks	high
60546	Scientific Linux Security Update : evolution on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60545	Scientific Linux Security Update : evolution-data-server on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60544	Scientific Linux Security Update : evolution and evolution-data-server on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41508	SuSE 10 Security Update : evolution-data-server (ZYPP Patch Number 6166)	Nessus	SuSE Local Security Checks	medium
41386	SuSE 11 Security Update : Evolution (SAT Patch Number 778)	Nessus	SuSE Local Security Checks	medium
40214	openSUSE Security Update : evolution (evolution-776)	Nessus	SuSE Local Security Checks	medium
39957	openSUSE Security Update : evolution-data-server (evolution-data-server-782)	Nessus	SuSE Local Security Checks	medium
39334	Debian DSA-1813-1 : evolution-data-server - Several vulnerabilities	Nessus	Debian Local Security Checks	high
38894	CentOS 4 : evolution / evolution-data-server (CESA-2009:0355)	Nessus	CentOS Local Security Checks	high
38893	CentOS 4 : evolution-data-server (CESA-2009:0354)	Nessus	CentOS Local Security Checks	high
38644	openSUSE 10 Security Update : evolution-data-server (evolution-data-server-6171)	Nessus	SuSE Local Security Checks	medium
37872	Fedora 10 : evolution-data-server-2.24.5-4.fc10 (2009-2784)	Nessus	Fedora Local Security Checks	medium
37259	Mandriva Linux Security Advisory : evolution-data-server (MDVSA-2009:078)	Nessus	Mandriva Local Security Checks	high
35962	Fedora 9 : evolution-data-server-2.22.3-3.fc9 (2009-2792)	Nessus	Fedora Local Security Checks	medium
35947	RHEL 3 : evolution (RHSA-2009:0358)	Nessus	Red Hat Local Security Checks	high
35946	RHEL 4 : evolution and evolution-data-server (RHSA-2009:0355)	Nessus	Red Hat Local Security Checks	critical
35945	RHEL 4 / 5 : evolution-data-server (RHSA-2009:0354)	Nessus	Red Hat Local Security Checks	high
35931	CentOS 3 : evolution (CESA-2009:0358)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2009-0582

high

Tenable Plugins

high

high

high

high

high

high

medium

medium

medium

medium

high

high

high

medium

medium

high

medium

high

critical

high

high