Alin Rad Pop of the Secunia Research discovered following issue affecting
evolution's iCalendar handling code:
A boundary error exists when replying to an iCalendar request while
in calendar view. This can be exploited to cause a heap-based buffer
overflow via an overly long "DESCRIPTION" property string included in an
Successful exploitation allows execution of arbitrary code, but requires
that the user accepts the iCalendar request and replies to it from the
The vulnerability is present within the "html_new_lines_for()"
function in calendar/gui/itip-utils.c from line 190 on.
char *html_string = (char *) malloc (sizeof (char)* (3500));
[ ... ]
strcpy(html_string, (const char*) string);
Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.
Created attachment 306797 [details]
Damn, that's about the most poorly written source code I've seen all week.
Here's a patch for it.
Upstream approved the patch in comment #3.
Public now, lifting embargo:
evolution-2.10.3-10.fc7 has been submitted as an update for Fedora 7
evolution-2.12.3-5.fc8 has been submitted as an update for Fedora 8
evolution-2.22.2-2.fc9 has been submitted as an update for Fedora 9
Possible mitigations that can be used to reduce risk before updating to fixed
Do not reply to meeting requests from the Calendar view. Do not accept
untrusted meeting requests to you calendar.
evolution-2.22.2-2.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report.
evolution-2.12.3-5.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
evolution-2.10.3-10.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
This issue was addressed in:
Red Hat Enterprise Linux: