Evolution: Integer overflow in camel-lock-helper — GLSA 200501-35

An overflow in the camel-lock-helper application can be exploited by an attacker to execute arbitrary code with elevated privileges.

Affected packages

Background

Evolution is a GNOME groupware application similar to Microsoft Outlook.

Description

Max Vozeler discovered an integer overflow in the camel-lock-helper application, which is installed as setgid mail by default.

Impact

A local attacker could exploit this vulnerability to execute malicious code with the privileges of the 'mail' group. A remote attacker could also setup a malicious POP server to execute arbitrary code when an Evolution user connects to it.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=mail-client/evolution-2.0.2-r1"

References

• CAN-2005-0102

Release date
January 24, 2005

Latest revision
January 24, 2005: 01

Severity
high

Exploitable
local and remote

Bugzilla entries

• 79183