Summary
This host is installed with Evolution Data Server and is prone to multiple integer overflow vulnerabilities.
Impact
Successful exploitation will let the attacker execute arbitrary codes through long string that is converted to a base64 representation and can cause a client crash via NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.
Solution
Upgrade to latest version 2.26
http://projects.gnome.org/evolution/download.shtml
Insight
- bug in Camel library while processing NTLM SASL packets.
- bug in glib library while encoding and decoding Base64 data.
Affected
Evolution Data Server version 2.24.5 and prior.
Evolution Data Server version in range 2.25.x to 2.25.92
References
Severity
Classification
-
CVE CVE-2009-0582, CVE-2009-0587 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities