LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: April 7th, 2014
Linux Advisory Watch: April 4th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
RedHat: Important: evolution-data-server security update Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
RedHat Linux Updated evolution-data-server package that fixes a security bug are now available for Red Hat Enterprise Linux 5.A flaw was found in the way evolution-data-server processes certain IMAP server messages. If a user can be tricked into connecting to a malicious IMAP server it may be possible to execute arbitrary code as the user running the evolution-data-server process. This update has been rated as having important security impact by the Red Hat Security Response Team.
- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Important: evolution-data-server security update
Advisory ID:       RHSA-2007:0510-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0510.html
Issue date:        2007-06-25
Updated on:        2007-06-25
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-3257 
- ---------------------------------------------------------------------

1. Summary:

Updated evolution-data-server package that fixes a security bug are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Problem description:

The evolution-data-server package provides a unified backend for programs
that work with contacts, tasks, and calendar information.

A flaw was found in the way evolution-data-server processes certain IMAP
server messages. If a user can be tricked into connecting to a malicious
IMAP server it may be possible to execute arbitrary code as the user
running the evolution-data-server process. (CVE-2007-3257) 

All users of evolution-data-server should upgrade to these updated
packages, which contain a backported patch which resolves this issue.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

244277 - CVE-2007-3257 evolution malicious server arbitrary code execution

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/evolution-data-server-1.8.0-15.0.4.el5.src.rpm
2e2bace8c0c9c0622af64a4ceb8af27b  evolution-data-server-1.8.0-15.0.4.el5.src.rpm

i386:
991bac4eabba789bfc37d89558391ead  evolution-data-server-1.8.0-15.0.4.el5.i386.rpm
46beae4ab714cb1c33524e14e8d15034  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.i386.rpm

x86_64:
991bac4eabba789bfc37d89558391ead  evolution-data-server-1.8.0-15.0.4.el5.i386.rpm
e4e5804b5502edae8ebc25a62eaa7d4b  evolution-data-server-1.8.0-15.0.4.el5.x86_64.rpm
46beae4ab714cb1c33524e14e8d15034  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.i386.rpm
92c141a8aa5dc69ac215c5f065e219b0  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/evolution-data-server-1.8.0-15.0.4.el5.src.rpm
2e2bace8c0c9c0622af64a4ceb8af27b  evolution-data-server-1.8.0-15.0.4.el5.src.rpm

i386:
46beae4ab714cb1c33524e14e8d15034  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.i386.rpm
d24bdb9b5d66dc3cb51d9e4b9f931dfb  evolution-data-server-devel-1.8.0-15.0.4.el5.i386.rpm

x86_64:
46beae4ab714cb1c33524e14e8d15034  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.i386.rpm
92c141a8aa5dc69ac215c5f065e219b0  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.x86_64.rpm
d24bdb9b5d66dc3cb51d9e4b9f931dfb  evolution-data-server-devel-1.8.0-15.0.4.el5.i386.rpm
164cd133011a5af940db7603f2d9f146  evolution-data-server-devel-1.8.0-15.0.4.el5.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/evolution-data-server-1.8.0-15.0.4.el5.src.rpm
2e2bace8c0c9c0622af64a4ceb8af27b  evolution-data-server-1.8.0-15.0.4.el5.src.rpm

i386:
991bac4eabba789bfc37d89558391ead  evolution-data-server-1.8.0-15.0.4.el5.i386.rpm
46beae4ab714cb1c33524e14e8d15034  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.i386.rpm
d24bdb9b5d66dc3cb51d9e4b9f931dfb  evolution-data-server-devel-1.8.0-15.0.4.el5.i386.rpm

ia64:
2683e2baf05824422332d72c227db789  evolution-data-server-1.8.0-15.0.4.el5.ia64.rpm
657295d09bba55256bf034b11cea84cd  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.ia64.rpm
3b4acca22457a8cfea16ba30afc764e5  evolution-data-server-devel-1.8.0-15.0.4.el5.ia64.rpm

ppc:
aedbfbb79c18a440f3936c03883cdddc  evolution-data-server-1.8.0-15.0.4.el5.ppc.rpm
4b5a705dc0bad79549bed26d037a55da  evolution-data-server-1.8.0-15.0.4.el5.ppc64.rpm
2ddc4583a9cda883be95d6e01859a65f  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.ppc.rpm
6295ed5a65b37a5150ccee8bcc88c392  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.ppc64.rpm
aa1ca7b529c5bcc7ae719d05486ee94b  evolution-data-server-devel-1.8.0-15.0.4.el5.ppc.rpm
4cfbff30d8e71c09051e9cf92331dbf0  evolution-data-server-devel-1.8.0-15.0.4.el5.ppc64.rpm

s390x:
c58c5c1d201435a899db9556c21ad930  evolution-data-server-1.8.0-15.0.4.el5.s390.rpm
707f634610f64c528c71a23faa68acb7  evolution-data-server-1.8.0-15.0.4.el5.s390x.rpm
1f8313ce3c10eed5e6f4a945b713680f  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.s390.rpm
39851ef88330f65e68081db5551d1303  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.s390x.rpm
1b028eb91e931b18f460165275c36115  evolution-data-server-devel-1.8.0-15.0.4.el5.s390.rpm
887ce4a8b8006771bace700d41a9f210  evolution-data-server-devel-1.8.0-15.0.4.el5.s390x.rpm

x86_64:
991bac4eabba789bfc37d89558391ead  evolution-data-server-1.8.0-15.0.4.el5.i386.rpm
e4e5804b5502edae8ebc25a62eaa7d4b  evolution-data-server-1.8.0-15.0.4.el5.x86_64.rpm
46beae4ab714cb1c33524e14e8d15034  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.i386.rpm
92c141a8aa5dc69ac215c5f065e219b0  evolution-data-server-debuginfo-1.8.0-15.0.4.el5.x86_64.rpm
d24bdb9b5d66dc3cb51d9e4b9f931dfb  evolution-data-server-devel-1.8.0-15.0.4.el5.i386.rpm
164cd133011a5af940db7603f2d9f146  evolution-data-server-devel-1.8.0-15.0.4.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3257
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.