Bugzilla – Bug 65116
VUL-0: CVE-2005-0102: evolution: integer overflow in helper app
Last modified: 2021-10-27 15:41:22 UTC
Hi, we received the following through vendor-sec. ----- Forwarded message from Martin Schulze <joey@infodrom.org> ----- From: Martin Schulze <joey@infodrom.org> To: Free Software Distribution Vendors <vendor-sec@lst.de> User-Agent: Mutt/1.5.6+20040907i Subject: [vendor-sec] CAN-2005-0102: Arbitrary code execution in Evolution Errors-To: vendor-sec-admin@lst.de Date: Sun, 23 Jan 2005 11:18:45 +0100 Max Vozeler discovered an integer overflow in the helper application camel-lock-helper which runs setuid root or setgid mail inside of Evolution, a free grouware suite. A local attacker can cause the setuid root helper to execute arbitrary code with elevated privileges via a malicious POP server. This is public already. We tried to disclose this responsible with somebody from Novell who was also contacted by Max. However, despite "We are reviewing the patch and the issue." last Tuesday the fix was committed publically and announced: Message by NotZed: http://lists.ximian.com/archives/public/evolution-patches/2005-January/008672.html CVS commit: http://cvs.gnome.org/viewcvs/evolution/camel/camel-lock-helper.c?rev=1.7&hideattic=0&view=log I'm sorry for this. We're going to fix this with the attached patch. Since this one is public already I don't want to wait too long with updates, so no or little coordination is possible. We're probably going for Monday or Tuesday. Regards, Joey -- GNU does not eliminate all the world's problems, only some of them. -- The GNU Manifesto --- evolution-1.0.5.orig/camel/camel-lock-helper.c 2001-10-27 18:59:27.000000000 +0200 +++ evolution-1.0.5/camel/camel-lock-helper.c 2005-01-21 16:57:44.000000000 +0100 @@ -360,6 +360,8 @@ int main(int argc, char **argv) switch(msg.id) { case CAMEL_LOCK_HELPER_LOCK: res = CAMEL_LOCK_HELPER_STATUS_NOMEM; + if (msg.data+1 < msg.data) + break; path = malloc(msg.data+1); if (path != NULL) { res = CAMEL_LOCK_HELPER_STATUS_PROTOCOL; ----- End forwarded message -----
<!-- SBZ_reproduce --> .
Comparing upper mentioned patch and CVS version, it seems, that both does the same. Will apply upped mentioned one. The bug moved to evolution-data-server in newer versions.
There is a difference: version in CVS returns CAMEL_LOCK_HELPER_STATUS_PROTOCOL, this one returns CAMEL_LOCK_HELPER_STATUS_NOMEM. Version in CVS may not work. Because msg.data is declared as uint32, (msg.data+1 < msg.data) is true for 2^32, for CVS version, comparison is done against 0xffff. Will apply CVS version.
Fix submitted for: evolution-data-server: STABLE, PLUS evolution: 8.1, 8.2, 9.0, 9.1, 9.2, SLES9-SLD, SLES8-SLEC.
Thanks. I'll do swamp and patchinfo files tomorrow.
Hm, looks like we don't have the app. installed setuid.
SM-Tracker-216
`patchinfo-box.evolution' -> `/work/src/done/PATCHINFO/patchinfo-box.evolution' `patchinfo-box.evolution-data-server' -> `/work/src/done/PATCHINFO/patchinfo-box.evolution-data-server' `patchinfo-box92.evolution' -> `/work/src/done/PATCHINFO/patchinfo-box92.evolution' `patchinfo-sld.evolution' -> `/work/src/done/PATCHINFO/patchinfo-sld.evolution' `patchinfo-sld.evolution-data-server' -> `/work/src/done/PATCHINFO/patchinfo-sld.evolution-data-server' `patchinfo-slec.evolution' -> `/work/src/done/PATCHINFO/patchinfo-slec.evolution'
Please look again at package list: patchinfo-sld.evolution-data-server. Patch for evolution-data-server was submitted only to STABLE and PLUS.
removed /work/src/done/PATCHINFO/patchinfo-sld.evolution
can you also submit packages for NLD-BETA (NLD SP1)? It has a changed evolution / evolution-data-server
Thomas, didn't you erase the wrong patchinfo?
Stupid! I did so... removed /work/src/done/PATCHINFO/patchinfo-sld.evolution-data-server and put the other file back. :)
Fix submitted also for evolution NLD SP1.
approved SLES8/9 and Box packages I'll leave this bug open for NLD...
updates released everywhere, right? i do not see the NLD version anymore. NLD-SP1 will have it too.
I have submitted it for SLES9-SLD and later for SLES9-SLD-BETA. See /work/SRC/old-versions/9.1/SLD/all/evolution/evolution.changes /work/SRC/old-versions/9.1/SLD-BETA/all/evolution/evolution.changes
CVE-2005-0102: CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)