CVE-2011-3201: Infoleak
GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.
Other sources
This is another Evolution security issue that I found upstream but presume also affects Fedora and would like to put on the Fedora security team's radar. If my filing such bugs is not appreciated, please let me know and I will stop.
Description of problem: Evolution registers a "mailto:" URL handler that accepts a parameter to attach a local file. Thus, a web site can launch the composer on an email with a confidential file attached and try to trick the user into sending it.
Version-Release number of selected component (if applicable): Upstream gnome-3-0 branch as of 2011-08-24
How reproducible: Always
Steps to Reproduce: 1. Go to https://mattmccutchen.net/private/evolution-mailto-test . 2. Click "Send" in the composer.
Actual results: Your SSH private key is emailed to me.
Expected results: A prompt is shown and you decline to attach the private key.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3201?
CVE-2011-3201 is considered to be of medium severity due to its potential to allow unauthorized access to arbitrary files.
How do I fix CVE-2011-3201?
The recommended fix for CVE-2011-3201 is to upgrade to GNOME Evolution version 3.2.3 or later.
Which versions of GNOME Evolution are affected by CVE-2011-3201?
CVE-2011-3201 affects multiple versions of GNOME Evolution prior to 3.2.3.
Can CVE-2011-3201 be exploited without user interaction?
Exploitation of CVE-2011-3201 requires user interaction to trigger the file reading via a mailto: URL.
What platforms are affected by CVE-2011-3201?
CVE-2011-3201 affects GNOME Evolution on various platforms, including Oracle Solaris and Red Hat Enterprise Linux.