Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.

From Red Hat Security Advisory 2009:0358 :

Updated evolution packages that fixes multiple security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications, and personal information management (PIM) tools for the GNOME desktop environment.

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

An integer overflow flaw which could cause heap-based buffer overflow was found in the Base64 encoding routine used by evolution. This could cause evolution to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of evolution must be restarted for the update to take effect.

From Red Hat Security Advisory 2009:0355 :

Updated evolution and evolution-data-server packages that fixes multiple security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications, and personal information management (PIM) tools for the GNOME desktop environment.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task and calendar information. Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by evolution and evolution-data-server. This could cause evolution, or an application using evolution-data-server, to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution and evolution-data-server are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of evolution and evolution-data-server must be restarted for the update to take effect.

From Red Hat Security Advisory 2009:0354 :

Updated evolution-data-server and evolution28-evolution-data-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task, and calendar information.
Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that Evolution Data Server did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause an application using Evolution Data Server to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by Evolution Data Server. This could cause an application using Evolution Data Server to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution-data-server and evolution28-evolution-data-server are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Evolution Data Server and applications using it (such as Evolution) must be restarted for the update to take effect.

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

An integer overflow flaw which could cause heap-based buffer overflow was found in the Base64 encoding routine used by evolution. This could cause evolution to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All running instances of evolution must be restarted for the update to take effect.

Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that Evolution Data Server did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause an application using Evolution Data Server to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by Evolution Data Server. This could cause an application using Evolution Data Server to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All running instances of Evolution Data Server and applications using it (such as Evolution) must be restarted for the update to take effect.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task and calendar information. Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by evolution and evolution-data-server. This could cause evolution, or an application using evolution-data-server, to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All running instances of evolution and evolution-data-server must be restarted for the update to take effect.

The following bugs have been fixed :

evolution considered S/MIME signatures to be valid even for modified mails (CVE-2009-0547). specially crafted base64 encoded messages could cause a heap buffer overflow (CVE-2009-0587). A POP3 server sending overly long lines could crash evolution.

This update fixes the following vulnerability :

evolution considered S/MIME signatures to be valid even for modified mails. (CVE-2009-0547: CVSS v2 Base Score: 5.0)

Additionally the following bug has been fixed :

  - A POP3 server sending overly long lines could crash     evolution.

Several vulnerabilities have been found in evolution-data-server, the database backend server for the evolution groupware suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0587     It was discovered that evolution-data-server is prone to     integer overflows triggered by large base64 strings.

  - CVE-2009-0547     Joachim Breitner discovered that S/MIME signatures are     not verified properly, which can lead to spoofing     attacks.

  - CVE-2009-0582     It was discovered that NTLM authentication challenge     packets are not validated properly when using the NTLM     authentication method, which could lead to an     information disclosure or a denial of service.

Updated evolution and evolution-data-server packages that fixes multiple security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications, and personal information management (PIM) tools for the GNOME desktop environment.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task and calendar information. Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by evolution and evolution-data-server. This could cause evolution, or an application using evolution-data-server, to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution and evolution-data-server are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of evolution and evolution-data-server must be restarted for the update to take effect.

Updated evolution-data-server and evolution28-evolution-data-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution Data Server provides a unified back-end for applications which interact with contacts, task, and calendar information.
Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.

Evolution Data Server did not properly check the Secure/Multipurpose Internet Mail Extensions (S/MIME) signatures used for public key encryption and signing of e-mail messages. An attacker could use this flaw to spoof a signature by modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

It was discovered that Evolution Data Server did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause an application using Evolution Data Server to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

Multiple integer overflow flaws which could cause heap-based buffer overflows were found in the Base64 encoding routines used by Evolution Data Server. This could cause an application using Evolution Data Server to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution-data-server and evolution28-evolution-data-server are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Evolution Data Server and applications using it (such as Evolution) must be restarted for the update to take effect.

A wrong handling of signed Secure/Multipurpose Internet Mail Extensions (S/MIME) e-mail messages enables attackers to spoof its signatures by modifying the latter copy (CVE-2009-0547).

Crafted authentication challange packets (NT Lan Manager type 2) sent by a malicious remote mail server enables remote attackers either to cause denial of service and to read information from the process memory of the client (CVE-2009-0582).

Multiple integer overflows in Base64 encoding functions enables attackers either to cause denial of service and to execute arbitrary code (CVE-2009-0587).

This update provides fixes for those vulnerabilities.

Update :

evolution-data-server packages from Mandriva Linux distributions 2008.1 and 2009.0 are not affected by CVE-2009-0587.

It was discovered that the Base64 encoding functions in evolution-data-server did not properly handle large strings. If a user were tricked into opening a specially crafted image file, or tricked into connecting to a malicious server, an attacker could possibly execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated evolution packages that fixes multiple security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact management, communications, and personal information management (PIM) tools for the GNOME desktop environment.

It was discovered that evolution did not properly validate NTLM (NT LAN Manager) authentication challenge packets. A malicious server using NTLM authentication could cause evolution to disclose portions of its memory or crash during user authentication. (CVE-2009-0582)

An integer overflow flaw which could cause heap-based buffer overflow was found in the Base64 encoding routine used by evolution. This could cause evolution to crash, or, possibly, execute an arbitrary code when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
All running instances of evolution must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2009:0355 advisory.

    Evolution is the integrated collection of e-mail, calendaring, contact     management, communications, and personal information management (PIM) tools     for the GNOME desktop environment.

    Evolution Data Server provides a unified back-end for applications which     interact with contacts, task and calendar information. Evolution Data     Server was originally developed as a back-end for Evolution, but is now     used by multiple other applications.

    Evolution did not properly check the Secure/Multipurpose Internet Mail     Extensions (S/MIME) signatures used for public key encryption and signing     of e-mail messages. An attacker could use this flaw to spoof a signature by     modifying the text of the e-mail message displayed to the user. (CVE-2009-0547)

    It was discovered that evolution did not properly validate NTLM (NT LAN     Manager) authentication challenge packets. A malicious server using NTLM     authentication could cause evolution to disclose portions of its memory or     crash during user authentication. (CVE-2009-0582)

    Multiple integer overflow flaws which could cause heap-based buffer     overflows were found in the Base64 encoding routines used by evolution and     evolution-data-server. This could cause evolution, or an application using     evolution-data-server, to crash, or, possibly, execute an arbitrary code     when large untrusted data blocks were Base64-encoded. (CVE-2009-0587)

    All users of evolution and evolution-data-server are advised to upgrade to     these updated packages, which contain backported patches to correct these     issues. All running instances of evolution and evolution-data-server must     be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
67827	Oracle Linux 3 : evolution (ELSA-2009-0358)	Nessus	Oracle Linux Local Security Checks	high
67826	Oracle Linux 4 : evolution / evolution-data-server (ELSA-2009-0355)	Nessus	Oracle Linux Local Security Checks	high
67825	Oracle Linux 4 / 5 : evolution-data-server (ELSA-2009-0354)	Nessus	Oracle Linux Local Security Checks	high
60546	Scientific Linux Security Update : evolution on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60545	Scientific Linux Security Update : evolution-data-server on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60544	Scientific Linux Security Update : evolution and evolution-data-server on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
49847	SuSE 10 Security Update : evolution-data-server (ZYPP Patch Number 7029)	Nessus	SuSE Local Security Checks	high
45036	SuSE 11 Security Update : evolution-data-server (SAT Patch Number 1944)	Nessus	SuSE Local Security Checks	high
39334	Debian DSA-1813-1 : evolution-data-server - Several vulnerabilities	Nessus	Debian Local Security Checks	high
38894	CentOS 4 : evolution / evolution-data-server (CESA-2009:0355)	Nessus	CentOS Local Security Checks	high
38893	CentOS 4 : evolution-data-server (CESA-2009:0354)	Nessus	CentOS Local Security Checks	high
37259	Mandriva Linux Security Advisory : evolution-data-server (MDVSA-2009:078)	Nessus	Mandriva Local Security Checks	high
36746	Ubuntu 6.06 LTS / 7.10 : evolution-data-server vulnerability (USN-733-1)	Nessus	Ubuntu Local Security Checks	high
35947	RHEL 3 : evolution (RHSA-2009:0358)	Nessus	Red Hat Local Security Checks	high
35946	RHEL 4 : evolution and evolution-data-server (RHSA-2009:0355)	Nessus	Red Hat Local Security Checks	critical
35945	RHEL 4 / 5 : evolution-data-server (RHSA-2009:0354)	Nessus	Red Hat Local Security Checks	high
35931	CentOS 3 : evolution (CESA-2009:0358)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2009-0587

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high

high