CVE-2009-0582: gnome evolution-data-server Improper Input Validation

Vulnerability summary

CVE-2009-0582 is a medium (CVSS 5.8) Improper Input Validation vulnerability in gnome evolution-data-server. EPSS estimates a 2.27% chance of exploitation in the next 30 days, higher than 82.7% of scored vulnerabilities.

Timeline

1. 14-03-2009
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.