This is a multi-part message in MIME format.

------_=_NextPart_001_01C59DB3.BA8A08B4
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

* SITIC Vulnerability Advisory *

Advisory Name: Evolution multiple remote format string bugs
Advisory Reference: SA05-001
Date of initial release: 2005-08-10
Product: Evolution 1.5, 2.0, 2.1, 2.2, 2.3
Platform: Linux, BSD systems, Unix
Effect: Remote code execution
Vulnerability Identifier: Not assigned


Overview:

Evolution suffers from several format string bugs when handling data =
from
remote sources. These bugs lead to crashes or the execution of arbitrary
assembly language code.


Details:

1) The first format string bug occurs when viewing the full vCard data
attached to an e-mail message.

When opening an e-mail message, only a compact view of some of the =
fields
from the vCard is displayed, and this does not trigger the =
vulnerability.
To be affected, the user must click on Show Full vCard or perform =
similar
actions such as clicking on Save in Addressbook and then viewing the =
saved
data under the Contacts tab.

Why is this important? An attacker might notice that an organisation =
uses
Evolution, for instance after seeing the "X-Mailer: Evolution x.y.z" =
e-mail
header in their e-mails. He or she could then send out e-mail messages =
with
malicious vCards to many e-mail accounts at the organisation, in the =
hope
that some of the recipients will view the full vCard data sooner or =
later,
thus exposing the organisation to this format string bug.


2) The second format string bug occurs when displaying contact data from
remote LDAP servers.


3) The third format string bug occurs when displaying task list data =
from
remote servers.


4) The fourth, and least serious, format string bug occurs when the user
goes to the Calendars tab to save task list data that is vulnerable to
problem 3 above. Other calendar entries that do not come from task lists
are also affected.


Mitigating factors:

Users that never use any of the vulnerable features in Evolution are not
affected.


Affected versions:

o Evolution 1.5 to Evolution 2.3.6.1


Recommendations:

We recommend that users either upgrade to Evolution 2.3.7 (unstable) or
apply our unofficial patch to their Evolution installation.


Patch information:

Evolution 2.3.7 is available from the following source:

o http://ftp.gnome.org/pub/gnome/sources/evolution/

Our unofficial patch is available from our home page:

o http://www.sitic.se


Acknowledgments:

These vulnerabilities were discovered by Ulf Harnhammar for SITIC, =
Swedish
IT Incident Centre.


Contact information:

Swedish IT Incident Centre, SITIC
P O Box 5398, SE-102 49 Stockholm, Sweden
Telephone: +46-8-678 5799
Email: sitic at pts dot se
http://www.sitic.se


Revision history:

First published 2005-08-10


About SITIC:

The Swedish IT Incident Centre within the National Post and Telecom =
Agency
has the task to support society in working with protection against IT
incidents. SITIC facilitates exchange of information regarding IT =
incidents
between organisations in society, and disseminates information about new
problems which potentially may impede the functionality of IT systems. =
In
addition, SITIC provides information and advice regarding proactive =
measures
and compiles and publishes statistics.


Disclaimer:

The decision to follow or act on information or advice contained in this
Vulnerability Advisory is the responsibility of each user or =
organisation.
SITIC accepts no responsibility for any errors or omissions contained =
within
this Vulnerability Advisory, nor for any consequences which may arise =
from
following or acting on information or advice contained herein.

------_=_NextPart_001_01C59DB3.BA8A08B4
Content-Type: application/octet-stream;
name="evolution.formatstring.patch"
Content-Transfer-Encoding: base64
Content-Description: evolution.formatstring.patch
Content-Disposition: attachment;
filename="evolution.formatstring.patch"

LS0tIGNhbGVuZGFyL2d1aS9lLWNhbC1jb21wb25lbnQtcHJldm lldy5jLm9sZAkyMDA0LTA0LTE4
IDIwOjAxOjE5LjAwMDAwMDAwMCArMDIwMAorKysgY2FsZW5kYX IvZ3VpL2UtY2FsLWNvbXBvbmVu
dC1wcmV2aWV3LmMJMjAwNS0wOC0wMiAxMTo0NDo0OS4wMDAwMD AwMDAgKzAyMDAKQEAgLTI4NSw3
ICsyODUsNyBAQCB3cml0ZV9odG1sIChHdGtIVE1MU3RyZWFtIC pzdHJlYW0sIEVDYWwgCiAJCQkJ
CXN0ciA9IGdfc3RyaW5nX2FwcGVuZF9jIChzdHIsIHRleHQudm FsdWVbaV0pOwogCQkJfQogCi0J
CQlndGtfaHRtbF9zdHJlYW1fcHJpbnRmIChzdHJlYW0sIHN0ci 0+c3RyKTsKKwkJCWd0a19odG1s
X3N0cmVhbV9wcmludGYgKHN0cmVhbSwgIiVzIiwgc3RyLT5zdH IpOwogCQkJZ19zdHJpbmdfZnJl
ZSAoc3RyLCBUUlVFKTsKIAkJfQogCi0tLSBhZGRyZXNzYm9vay 9ndWkvd2lkZ2V0cy9lYWItY29u
dGFjdC1kaXNwbGF5LmMub2xkCTIwMDUtMDItMTQgMTc6MDk6MD MuMDAwMDAwMDAwICswMTAwCisr
KyBhZGRyZXNzYm9vay9ndWkvd2lkZ2V0cy9lYWItY29udGFjdC 1kaXNwbGF5LmMJMjAwNS0wOC0w
MiAxMzozODoyMS4wMDAwMDAwMDAgKzAyMDAKQEAgLTMzOCw3IC szMzgsNyBAQCByZW5kZXJfY29u
dGFjdCAoR3RrSFRNTFN0cmVhbSAqaHRtbF9zdHJlCiAJYWNjdW 1fYXR0cmlidXRlIChhY2N1bSwg
Y29udGFjdCwgXygiWWFob28iKSwgRV9DT05UQUNUX0lNX1lBSE 9PX0hPTUVfMSwgWUFIT09fSUNP
TiwgMCk7CiAKIAlpZiAoYWNjdW0tPmxlbiA+IDApCi0JCWd0a1 9odG1sX3N0cmVhbV9wcmludGYg
KGh0bWxfc3RyZWFtLCBhY2N1bS0+c3RyKTsKKwkJZ3RrX2h0bW xfc3RyZWFtX3ByaW50ZiAoaHRt
bF9zdHJlYW0sICIlcyIsIGFjY3VtLT5zdHIpOwogCiAJZW5kX2 Jsb2NrIChodG1sX3N0cmVhbSk7
CiAKQEAgLTM1Myw3ICszNTMsNyBAQCByZW5kZXJfY29udGFjdC AoR3RrSFRNTFN0cmVhbSAqaHRt
bF9zdHJlCiAKIAlpZiAoYWNjdW0tPmxlbiA+IDApIHsKIAkJc3 RhcnRfYmxvY2sgKGh0bWxfc3Ry
ZWFtLCBfKCJ3b3JrIikpOwotCQlndGtfaHRtbF9zdHJlYW1fcH JpbnRmIChodG1sX3N0cmVhbSwg
YWNjdW0tPnN0cik7CisJCWd0a19odG1sX3N0cmVhbV9wcmludG YgKGh0bWxfc3RyZWFtLCAiJXMi
LCBhY2N1bS0+c3RyKTsKIAkJZW5kX2Jsb2NrIChodG1sX3N0cm VhbSk7CiAJfQogCkBAIC0zNjgs
NyArMzY4LDcgQEAgcmVuZGVyX2NvbnRhY3QgKEd0a0hUTUxTdH JlYW0gKmh0bWxfc3RyZQogCiAJ
aWYgKGFjY3VtLT5sZW4gPiAwKSB7CiAJCXN0YXJ0X2Jsb2NrIC hodG1sX3N0cmVhbSwgXygicGVy
c29uYWwiKSk7Ci0JCWd0a19odG1sX3N0cmVhbV9wcmludGYgKG h0bWxfc3RyZWFtLCBhY2N1bS0+
c3RyKTsKKwkJZ3RrX2h0bWxfc3RyZWFtX3ByaW50ZiAoaHRtbF 9zdHJlYW0sICIlcyIsIGFjY3Vt
LT5zdHIpOwogCQllbmRfYmxvY2sgKGh0bWxfc3RyZWFtKTsKIA l9CiAKLS0tIGNhbGVuZGFyL2d1
aS9lLWNhbGVuZGFyLXZpZXcuYy5vbGQJMjAwNS0wMi0xNCAxNz owOTowNC4wMDAwMDAwMDAgKzAx
MDAKKysrIGNhbGVuZGFyL2d1aS9lLWNhbGVuZGFyLXZpZXcuYw kyMDA1LTA4LTAyIDE0OjEyOjQ3
LjAwMDAwMDAwMCArMDIwMApAQCAtMTA3NCw3ICsxMDc0LDcgQE Agb25fc2F2ZV9hcyAoR3RrV2lk
Z2V0ICp3aWRnZXQsIGdwb2ludGVyIAogCQlyZXR1cm47CiAJfQ ogCQotCWZwcmludGYgKGZpbGUs
IGljYWxfc3RyaW5nKTsKKwlmcHJpbnRmIChmaWxlLCAiJXMiLC BpY2FsX3N0cmluZyk7CiAJZ19m
cmVlIChpY2FsX3N0cmluZyk7CiAJZmNsb3NlIChmaWxlKTsKIA otLS0gY2FsZW5kYXIvZ3VpL2Ut
Y2FsZW5kYXItdGFibGUuYy5vbGQJMjAwNC0wOS0yNCAxNzo0OT oyNy4wMDAwMDAwMDAgKzAyMDAK
KysrIGNhbGVuZGFyL2d1aS9lLWNhbGVuZGFyLXRhYmxlLmMJMj AwNS0wOC0wMiAxNDoxNToxMi4w
MDAwMDAwMDAgKzAyMDAKQEAgLTEyMTIsNyArMTIxMiw3IEBAIG VfY2FsZW5kYXJfdGFibGVfb25f
c2F2ZV9hcyAoR3RrV2lkZ2V0ICoKIAkJcmV0dXJuOwogCX0KIA kKLQlmcHJpbnRmIChmaWxlLCBp
Y2FsX3N0cmluZyk7CisJZnByaW50ZiAoZmlsZSwgIiVzIiwgaW NhbF9zdHJpbmcpOwogC***ZnJl
ZSAoaWNhbF9zdHJpbmcpOwogCWZjbG9zZSAoZmlsZSk7CiB9Cg ==

------_=_NextPart_001_01C59DB3.BA8A08B4--