Bug 448541 - (CVE-2008-1109) CVE-2008-1109 evolution: iCalendar buffer overflow via large description parameter
CVE-2008-1109 evolution: iCalendar buffer overflow via large description para...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
source=vendor-sec,reported=20080527,p...
: Security
Depends On: 448719 448720 448721 448722 449922 449923 449924 449925
Blocks:
  Show dependency treegraph
 
Reported: 2008-05-27 11:25 EDT by Tomas Hoger
Modified: 2010-02-24 01:01 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-06-06 04:00:06 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Patch (1.41 KB, patch)
2008-05-27 12:55 EDT, Matthew Barnes
no flags Details | Diff

  None (edit)
Description Tomas Hoger 2008-05-27 11:25:01 EDT
Alin Rad Pop of the Secunia Research discovered following issue affecting
evolution's iCalendar handling code:

A boundary error exists when replying to an iCalendar request while
in calendar view. This can be exploited to cause a heap-based buffer
overflow via an overly long "DESCRIPTION" property string included in an
iCalendar attachment.

Successful exploitation allows execution of arbitrary code, but requires
that the user accepts the iCalendar request and replies to it from the
"Calendars" window.

Vulnerability Details:
The vulnerability is present within the "html_new_lines_for()"
function in calendar/gui/itip-utils.c from line 190 on.

[calendar/gui/itip-utils.c:179]
	char *html_string = (char *) malloc (sizeof (char)* (3500));
        [ ... ]
	strcpy(html_string, (const char*) string);

Acknowledgements:

Red Hat would like to thank Alin Rad Pop of Secunia Research for responsibly disclosing this issue.
Comment 3 Matthew Barnes 2008-05-27 12:55:45 EDT
Created attachment 306797 [details]
Patch

Damn, that's about the most poorly written source code I've seen all week. 
Here's a patch for it.
Comment 6 Matthew Barnes 2008-05-28 07:37:02 EDT
Upstream approved the patch in comment #3.
Comment 11 Tomas Hoger 2008-06-04 05:41:40 EDT
Public now, lifting embargo:

  http://secunia.com/advisories/30298
  http://secunia.com/secunia_research/2008-23/advisory/
Comment 13 Fedora Update System 2008-06-04 07:12:19 EDT
evolution-2.10.3-10.fc7 has been submitted as an update for Fedora 7
Comment 14 Fedora Update System 2008-06-04 07:13:18 EDT
evolution-2.12.3-5.fc8 has been submitted as an update for Fedora 8
Comment 15 Fedora Update System 2008-06-04 07:15:03 EDT
evolution-2.22.2-2.fc9 has been submitted as an update for Fedora 9
Comment 16 Tomas Hoger 2008-06-04 07:38:31 EDT
Possible mitigations that can be used to reduce risk before updating to fixed
packages:

Do not reply to meeting requests from the Calendar view.  Do not accept
untrusted meeting requests to you calendar.
Comment 17 Fedora Update System 2008-06-06 03:47:34 EDT
evolution-2.22.2-2.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 18 Fedora Update System 2008-06-06 03:49:07 EDT
evolution-2.12.3-5.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 19 Fedora Update System 2008-06-06 03:49:26 EDT
evolution-2.10.3-10.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.