REDHAT-BUG-498648: High severity Gnome Evolution vulnerability
A Debian bug report [1] brought to light the fact that Evolution does not create its data files with appropriate permissions. Because of this, if user A on a system uses Evolut ion for email, user B can read any of user A's email. The default permissions for ~/.evolution is 0755, and the default permissions for Evolution data files is 0644 (although s trangely enough the default permissions for .index files is 0600).
As well, by default in Fedora and RHEL5, a user's home directory has mode 0755 permissions.
By contrast, Firefox creates ~/.mozilla/firefox as mode 0700, protecting user bookmarks and caches.
Evolution should probably create/enforce ~/.evolution being mode 0700.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526409
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-498648?
The severity of REDHAT-BUG-498648 is considered high due to risks of unauthorized access to user email.
How do I fix REDHAT-BUG-498648?
To fix REDHAT-BUG-498648, change the permissions of the ~/.evolution directory to 0700.
Which software is affected by REDHAT-BUG-498648?
The affected software for REDHAT-BUG-498648 is GNOME Evolution.
Can multiple users access each other's emails due to REDHAT-BUG-498648?
Yes, multiple users can access each other's emails because of the inappropriate file permissions in REDHAT-BUG-498648.
What file permissions are set incorrectly in REDHAT-BUG-498648?
The incorrect file permissions set in REDHAT-BUG-498648 are 0755 for the ~/.evolution directory.