CVE-2009-0582: Input Validation
It was discovered that camel's NTLM SASL authentication mechanism did not properly validate server's challenge packets (NTLM authentication type 2 packets, [1]). In the ntlmchallenge() in camel/camel-sasl-ntlm.c, length of the domain string that was copied from type 2 to type 3 packet (client's reply to server's challenge) was not properly validated against the rest of the data received from the server.
127 ntlmsetstring (ret, NTLMRESPONSEDOMAINOFFSET, 128 token->data + NTLMCHALLENGEDOMAINOFFSET, 129 atoi (token->data + NTLMCHALLENGEDOMAINLENOFFSET));
Server could specify larger length than the actual data sent in the packet, causing the client to disclose portion of its memory, or crash.
Note: length value was not properly extracted from the packet too, as it is not passed as string, rather as 16-bit LE value.
[1] http://curl.haxx.se/rfc/ntlm.html#theType2Message
Other sources
The ntlmchallenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0582?
CVE-2009-0582 is classified as a medium severity vulnerability.
How do I fix CVE-2009-0582?
To fix CVE-2009-0582, update the Evolution Data Server to a version that is not affected by this vulnerability.
What versions of software are affected by CVE-2009-0582?
CVE-2009-0582 affects Evolution Data Server versions up to 2.24.5 and version 2.25.92.
What type of vulnerability is CVE-2009-0582?
CVE-2009-0582 is a flaw in the NTLM SASL authentication mechanism due to improper validation of server's challenge packets.
Can CVE-2009-0582 lead to unauthorized access?
Yes, CVE-2009-0582 can potentially lead to unauthorized access due to its impact on NTLM authentication.