CVE-2009-3721: Path Traversal

Yorick Koster discovered multiple security issues in yTNEF and Evolution's TNEF plugin (based on yTNEF), which are described in oCERT-2009-013 advisory:

http://www.ocert.org/advisories/ocert-2009-013.html

yTNEF, an open source filter program that decodes Transport Neutral Encapsulation Format (TNEF) e-mail attachments, and the Evolution TNEF attachment decoder plugin suffer from directory traversal and buffer overflow vulnerabilities.

The vulnerabilities lead to arbitrary code execution with the privilege of the target user running the decoders.

The directory traversal vulnerability is caused by improper sanitization of the file name used for saving the attachments, as it is computed directly from properties contained in the TNEF structure without checking for conditions that allow to traverse outside the temporary directory used for attachment storage. This leads to arbitrary code execution in case the attacker crafts an attachment that would overwrite a file used for execution (as an example the bashrc profile).

Additionally buffer and heap overflow vulnerabilities can be triggered by passing a file name exceeding a fixed size of 256 bytes in the TNEF data structure. This can lead to arbitrary code execution if exploited.

Further details can be found in Yorick's advisory: http://www.akitasecurity.nl/advisory.php?id=AK20090601

There's no official upstream fix for the issues. Both yTNEF and Evolution's TNEF plugin are unmaintained according to oCERT's advisory.

— Red Hat