Date: Sat, 5 Sep 2009 12:47:33 +0100 From: Andrea Barisani <lcars@...rt.org> To: oss-security@...ts.openwall.com, ocert-announce@...ts.ocert.org, bugtraq@...urityfocus.com Subject: [oCERT-2009-013] yTNEF/Evolution TNEF attachment decoder input sanitization errors #2009-013 yTNEF/Evolution TNEF attachment decoder input sanitization errors Description: yTNEF, an open source filter program that decodes Transport Neutral Encapsulation Format (TNEF) e-mail attachments, and the Evolution TNEF attachment decoder plugin suffer from directory traversal and buffer overflow vulnerabilities. The vulnerabilities lead to arbitrary code execution with the privilege of the target user running the decoders. The directory traversal vulnerability is caused by improper sanitization of the file name used for saving the attachments, as it is computed directly from properties contained in the TNEF structure without checking for conditions that allow to traverse outside the temporary directory used for attachment storage. This leads to arbitrary code execution in case the attacker crafts an attachment that would overwrite a file used for execution (as an example the bashrc profile). Additionally buffer and heap overflow vulnerabilities can be triggered by passing a file name exceeding a fixed size of 256 bytes in the TNEF data structure. This can lead to arbitrary code execution if exploited. Affected version: yTNEF, all versions Evolution TNEF plugin, all versions Fixed version: yTNEF, N/A Evolution TNEF plugin, N/A Credit: vulnerability report and PoC code received from Yorick Koster < yorick [at] akitasecurity [dot] nl >. CVE: N/A Timeline: 2009-07-09: vulnerability report received 2009-07-10: contacted ytnef and evolution maintainers 2009-07-11: former evolution plugin maintainer communicates that code is unmaintained, voluntarily deletes online copy 2009-07-21: contacted affected vendors, advising to remove or disable the unmaintained code 2009-09-05: advisory release References: http://www.akitasecurity.nl/advisory.php?id=AK20090601 Permalink: http://www.ocert.org/advisories/ocert-2009-013.html -- Andrea Barisani | Founder & Project Coordinator oCERT | Open Source Computer Emergency Response Team <lcars@...rt.org> http://www.ocert.org 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.