SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Client)  >   Evolution Vendors:   Gnome Development Team
Evolution Format String Bug in Encrypted E-mail emf_multipart_encrypted() Function Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1019540
SecurityTracker URL:  http://securitytracker.com/id/1019540
CVE Reference:   CVE-2008-0072   (Links to External Site)
Date:  Mar 5 2008
Impact:   Execution of arbitrary code via network, User access via network
Vendor Confirmed:  Yes  
Version(s): 2.12.3
Description:   A vulnerability was reported in Evolution. A remote user can execute arbitrary code on the target system.

A remote user can send a specially crafted e-mail message to trigger a format string flaw in emf_multipart_encrypted() and execute arbitrary code on the target system. The code will run with the privileges of

The vulnerability resides in 'mail/em-format.c'. A specially crafted 'Version:' field in an encrypted e-mail message can trigger the flaw.

The vendor was notified on March 3, 2008.

Ulf Harnhammar of Secunia Research reported this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.gnome.org/projects/evolution/ (Links to External Site)
Cause:   Input validation error, State error
Underlying OS:  Linux (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Mar 5 2008 (Red Hat Issues Fix) Evolution Format String Bug in Encrypted E-mail emf_multipart_encrypted() Function Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 4 and 5.
Mar 5 2008 (Red Hat Issues Fix) Evolution Format String Bug in Encrypted E-mail emf_multipart_encrypted() Function Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 4.5.z.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC