CVE-2009-1631: Low severity Gnome Evolution vulnerability
A Debian bug report [1] brought to light the fact that Evolution does not create its data files with appropriate permissions. Because of this, if user A on a system uses Evolut ion for email, user B can read any of user A's email. The default permissions for ~/.evolution is 0755, and the default permissions for Evolution data files is 0644 (although s trangely enough the default permissions for .index files is 0600).
As well, by default in Fedora and RHEL5, a user's home directory has mode 0755 permissions.
By contrast, Firefox creates ~/.mozilla/firefox as mode 0700, protecting user bookmarks and caches.
Evolution should probably create/enforce ~/.evolution being mode 0700.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409
Other sources
The Mailer component in Evolution 2.26.1 and earlier uses world-readable permissions for the .evolution directory, and certain directories and files under .evolution/ related to local mail, which allows local users to obtain sensitive information by reading these files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1631?
CVE-2009-1631 has a medium severity rating as it potentially allows unauthorized access to users' email data.
How do I fix CVE-2009-1631?
To fix CVE-2009-1631, you need to change the permissions of the ~/.evolution directory to restrict access.
What versions of GNOME Evolution are affected by CVE-2009-1631?
CVE-2009-1631 affects all versions of GNOME Evolution up to and including version 2.26.1.
What is the nature of the vulnerability in CVE-2009-1631?
The nature of the vulnerability in CVE-2009-1631 is improper file permissions allowing one user to read another user's email.
Is there a patch available for CVE-2009-1631?
Yes, patches are available in later versions of GNOME Evolution which correct the permission settings.