Skip to navigation

Security Advisory Moderate: evolution security update

Advisory: RHSA-2009:0358-9
Type: Security Advisory
Severity: Moderate
Issued on: 2009-03-16
Last updated on: 2009-03-16
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 3)
CVEs (cve.mitre.org): CVE-2009-0582
CVE-2009-0587

Details

Updated evolution packages that fixes multiple security issues are now
available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Evolution is the integrated collection of e-mail, calendaring, contact
management, communications, and personal information management (PIM) tools
for the GNOME desktop environment.

It was discovered that evolution did not properly validate NTLM (NT LAN
Manager) authentication challenge packets. A malicious server using NTLM
authentication could cause evolution to disclose portions of its memory or
crash during user authentication. (CVE-2009-0582)

An integer overflow flaw which could cause heap-based buffer overflow was
found in the Base64 encoding routine used by evolution. This could cause
evolution to crash, or, possibly, execute an arbitrary code when large
untrusted data blocks were Base64-encoded. (CVE-2009-0587)

All users of evolution are advised to upgrade to these updated packages,
which contain backported patches to correct these issues. All running
instances of evolution must be restarted for the update to take effect.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

Red Hat Desktop (v. 3)

IA-32:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/i386/evolution-1.4.5-25.el3.i386.rpm
Missing file
    MD5: 0bbb67a2c3b42e8fa4610bce7e65b9db
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/i386/evolution-devel-1.4.5-25.el3.i386.rpm
Missing file
    MD5: cb7253de4ea5c8b7af4c51eaa6aa64f8
 
x86_64:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/x86_64/evolution-1.4.5-25.el3.x86_64.rpm
Missing file
    MD5: d49aab94868b2a3aa91cda41d758f581
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/x86_64/evolution-devel-1.4.5-25.el3.x86_64.rpm
Missing file
    MD5: 2dcf853aa3f9fbe02cddf6c60b52bbc7
 
Red Hat Enterprise Linux AS (v. 3)

IA-32:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/i386/evolution-1.4.5-25.el3.i386.rpm
Missing file
    MD5: 0bbb67a2c3b42e8fa4610bce7e65b9db
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/i386/evolution-devel-1.4.5-25.el3.i386.rpm
Missing file
    MD5: cb7253de4ea5c8b7af4c51eaa6aa64f8
 
IA-64:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/ia64/evolution-1.4.5-25.el3.ia64.rpm
Missing file
    MD5: f156541630d7df84570cb57f639de2f5
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/ia64/evolution-devel-1.4.5-25.el3.ia64.rpm
Missing file
    MD5: 8b31434f7a9439df259e3a65ed7e750e
 
PPC:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/ppc/evolution-1.4.5-25.el3.ppc.rpm
Missing file
    MD5: dd8ae71d65a471862906fa9a4fea2d32
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/ppc/evolution-devel-1.4.5-25.el3.ppc.rpm
Missing file
    MD5: cb4a9307b021fa025f76b7d7f03d5a4f
 
s390:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/s390/evolution-1.4.5-25.el3.s390.rpm
Missing file
    MD5: 0308d31f8417226a0bb63c2f9ee73c62
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/s390/evolution-devel-1.4.5-25.el3.s390.rpm
Missing file
    MD5: 31e46a93bfee3d4b2f835533af1e2736
 
s390x:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/s390x/evolution-1.4.5-25.el3.s390x.rpm
Missing file
    MD5: 7b3acb98d15a013cc9981ceb46c60c84
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/s390x/evolution-devel-1.4.5-25.el3.s390x.rpm
Missing file
    MD5: 07b00e210c332cbb4efc2fc083a0e9ae
 
x86_64:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/x86_64/evolution-1.4.5-25.el3.x86_64.rpm
Missing file
    MD5: d49aab94868b2a3aa91cda41d758f581
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/x86_64/evolution-devel-1.4.5-25.el3.x86_64.rpm
Missing file
    MD5: 2dcf853aa3f9fbe02cddf6c60b52bbc7
 
Red Hat Enterprise Linux ES (v. 3)

IA-32:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/i386/evolution-1.4.5-25.el3.i386.rpm
Missing file
    MD5: 0bbb67a2c3b42e8fa4610bce7e65b9db
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/i386/evolution-devel-1.4.5-25.el3.i386.rpm
Missing file
    MD5: cb7253de4ea5c8b7af4c51eaa6aa64f8
 
IA-64:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/ia64/evolution-1.4.5-25.el3.ia64.rpm
Missing file
    MD5: f156541630d7df84570cb57f639de2f5
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/ia64/evolution-devel-1.4.5-25.el3.ia64.rpm
Missing file
    MD5: 8b31434f7a9439df259e3a65ed7e750e
 
x86_64:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/x86_64/evolution-1.4.5-25.el3.x86_64.rpm
Missing file
    MD5: d49aab94868b2a3aa91cda41d758f581
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/x86_64/evolution-devel-1.4.5-25.el3.x86_64.rpm
Missing file
    MD5: 2dcf853aa3f9fbe02cddf6c60b52bbc7
 
Red Hat Enterprise Linux WS (v. 3)

IA-32:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/i386/evolution-1.4.5-25.el3.i386.rpm
Missing file
    MD5: 0bbb67a2c3b42e8fa4610bce7e65b9db
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/i386/evolution-devel-1.4.5-25.el3.i386.rpm
Missing file
    MD5: cb7253de4ea5c8b7af4c51eaa6aa64f8
 
IA-64:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/ia64/evolution-1.4.5-25.el3.ia64.rpm
Missing file
    MD5: f156541630d7df84570cb57f639de2f5
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/ia64/evolution-devel-1.4.5-25.el3.ia64.rpm
Missing file
    MD5: 8b31434f7a9439df259e3a65ed7e750e
 
x86_64:
ftp://updates.redhat.com/rhn/public/NULL/evolution/1.4.5-25.el3/x86_64/evolution-1.4.5-25.el3.x86_64.rpm
Missing file
    MD5: d49aab94868b2a3aa91cda41d758f581
ftp://updates.redhat.com/rhn/public/NULL/evolution-devel/1.4.5-25.el3/x86_64/evolution-devel-1.4.5-25.el3.x86_64.rpm
Missing file
    MD5: 2dcf853aa3f9fbe02cddf6c60b52bbc7
 

Bugs fixed (see bugzilla for more information)

487685 - CVE-2009-0582 evolution-data-server: insufficient checking of NTLM authentication challenge packets
488226 - CVE-2009-0587 evolution-data-server: integer overflow in base64 encoding functions


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/