Description
The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | evolution-data-server | 2.26.1.1-1 | — |
| Debian 13 | evolution-data-server | 2.26.1.1-1 | — |
| Debian 12 | evolution-data-server | 2.26.1.1-1 | — |
| Debian 5.0 | evolution-data-server | 2.22.3-1.1+lenny1 | DSA-1813-1 |
| Debian 4.0 | evolution-data-server | 1.6.3-5etch2 | DSA-1813-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | evolution-data-server +2 | 1.12.3-10.el5_3.3 | RHSA-2009:0354 |
| RHEL 4 | evolution +1 | 2.0.2-41.el4_7.2 | RHSA-2009:0355 |
| RHEL 4 | evolution-data-server +1 | 1.0.2-14.el4_7.1 | RHSA-2009:0355 |
| RHEL 4 | evolution28-evolution-data-server +1 | 1.8.0-37.el4_7.2 | RHSA-2009:0354 |
| RHEL 3 | evolution +1 | 1.4.5-25.el3 | RHSA-2009:0358 |
Advisories 4
- RHSA-2009:0354 Red Hat Security Advisory: evolution-data-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0358 Red Hat Security Advisory: evolution security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:0355 Red Hat Security Advisory: evolution and evolution-data-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1813-1 evolution-data-server - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 35357 third-party-advisory
- 52673 vdb-entry
- ADV-2009-0716 vdb-entry
- FEDORA-2009-2792 vendor-advisory
- 34339 third-party-advisory
- RHSA-2009:0358 vendor-advisory
- 34348 third-party-advisory
- oval:org.mitre.oval:def:10081 vdb-entry signature
- 34363 third-party-advisory
- [release-team] 20090312 Another Evolution-Data-Server freeze break mailing-list
- 1021845 vdb-entry
- 35065 third-party-advisory
- evolution-ntlmsasl-info-disclosure(49233) vdb-entry
- 34109 vdb-entry
- RHSA-2009:0355 vendor-advisory
- DSA-1813 vendor-advisory
- SUSE-SR:2009:010 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=487685
- RHSA-2009:0354 vendor-advisory
- 34338 third-party-advisory
- FEDORA-2009-2784 vendor-advisory
- MDVSA-2009:078 vendor-advisory
- 34286 third-party-advisory