Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execute arbitrary code via a negative SEQUENCE value in GData, which is used as an array index.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2007-0510 advisory.

    [1.8.0-15.0.4.el5]
     - Add patch for RH bug #244293 (Camel IMAP security flaw).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0509 :

Updated evolution packages that fix a security bug are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Evolution is the GNOME collection of personal information management (PIM) tools.

A flaw was found in the way Evolution processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running evolution. (CVE-2007-3257)

All users of Evolution should upgrade to these updated packages, which contain a backported patch which resolves this issue.

A flaw was found in the way evolution-data-server processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running the evolution-data-server process. (CVE-2007-3257)

Evolution crushed in first-time wizard stage for timezones:
Europe/Moscow, Europe/Volgograd, Asia/Irkutsk, Asia/Makassar, Asia/Ujung_Pandang, Asia/Ulaanbaatar, Asia/Ulan_Bator. This bug is a consequence of removing TZNAME tag from timezone ICS VCARDs.

A flaw was found in the way Evolution processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running evolution. (CVE-2007-3257)

A malicious IMAP server could execute code within evolution by sending a malformed response to a SEQUENCE command. (CVE-2007-3257)

Philip Van Hoof discovered that the IMAP client in Evolution did not correctly verify the SEQUENCE value. A malicious or spoofed server could exploit this to execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200711-04 (Evolution: User-assisted remote execution of arbitrary code)

    The imap_rescan() function of the file camel-imap-folder.c does not     properly sanitize the 'SEQUENCE' response sent by an IMAP server before     being used to index arrays.
  Impact :

    A malicious or compromised IMAP server could trigger the vulnerability     and execute arbitrary code with the permissions of the user running     Evolution.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in Evolution, a groupware suite with mail client and organizer. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1002     Ulf Harnhammar discovered that a format string     vulnerability in the handling of shared calendars may     allow the execution of arbitrary code.

  - CVE-2007-3257     It was discovered that the IMAP code in the Evolution     Data Server performs insufficient sanitising of a value     later used an array index, which can lead to the     execution of arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200707-03 (Evolution: User-assisted remote execution of arbitrary code)

    The imap_rescan() function of the file camel-imap-folder.c does not     properly sanitize the 'SEQUENCE' response sent by an IMAP server before     being used to index arrays.
  Impact :

    A malicious or compromised IMAP server could trigger the vulnerability     and execute arbitrary code with the permissions of the user running     Evolution.
  Workaround :

    There is no known workaround at this time.

It was discovered that the IMAP code in the Evolution Data Server performs insufficient sanitising of a value later used an array index, which can lead to the execution of arbitrary code.

Updated evolution-data-server package that fixes a security bug are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The evolution-data-server package provides a unified backend for programs that work with contacts, tasks, and calendar information.

A flaw was found in the way evolution-data-server processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running the evolution-data-server process. (CVE-2007-3257)

All users of evolution-data-server should upgrade to these updated packages, which contain a backported patch which resolves this issue.

Updated evolution packages that fix a security bug are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Evolution is the GNOME collection of personal information management (PIM) tools.

A flaw was found in the way Evolution processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running evolution. (CVE-2007-3257)

All users of Evolution should upgrade to these updated packages, which contain a backported patch which resolves this issue.

A flaw in Evolution/evolution-data-server was found in how Evolution would process certain IMAP server messages. If a user were tricked into connecting to a malicious IMAP server, it was possible that arbitrary code could be executed with the privileges of the user using Evolution.

Updated packages have been patched to prevent this issue.

Debian project reports :

It was discovered that the IMAP code in the Evolution Data Server performs insufficient sanitising of a value later used an array index, which can lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
67526	Oracle Linux 5 : Important: / evolution-data-server (ELSA-2007-0510)	Nessus	Oracle Linux Local Security Checks	critical
67525	Oracle Linux 3 / 4 : evolution (ELSA-2007-0509)	Nessus	Oracle Linux Local Security Checks	medium
60214	Scientific Linux Security Update : evolution on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60213	Scientific Linux Security Update : evolution on SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
29423	SuSE 10 Security Update : evolution-data-server (ZYPP Patch Number 3826)	Nessus	SuSE Local Security Checks	medium
28076	Ubuntu 6.06 LTS / 6.10 / 7.04 : evolution-data-server vulnerability (USN-475-1)	Nessus	Ubuntu Local Security Checks	medium
27815	GLSA-200711-04 : Evolution: User-assisted remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
27211	openSUSE 10 Security Update : evolution-data-server (evolution-data-server-3825)	Nessus	SuSE Local Security Checks	medium
25675	Debian DSA-1325-1 : evolution - several vulnerabilities	Nessus	Debian Local Security Checks	medium
25661	GLSA-200707-03 : Evolution: User-assisted remote execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
25615	Debian DSA-1321-1 : evolution-data-server - programming error	Nessus	Debian Local Security Checks	medium
25607	RHEL 5 : evolution-data-server (RHSA-2007:0510)	Nessus	Red Hat Local Security Checks	medium
25606	RHEL 3 / 4 : evolution (RHSA-2007:0509)	Nessus	Red Hat Local Security Checks	medium
25602	Mandrake Linux Security Advisory : evolution (MDKSA-2007:136)	Nessus	Mandriva Local Security Checks	medium
25592	FreeBSD : evolution-data-server -- remote execution of arbitrary code vulnerability (b1b5c125-2308-11dc-b91a-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	medium
25577	CentOS 5 : evolution-data-server (CESA-2007:0510)	Nessus	CentOS Local Security Checks	medium
25576	CentOS 3 / 4 : evolution (CESA-2007:0509)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2007-3257

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium