NVD

Id
47911  
Name
CVE-2009-0582  
Description
The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:P)  
Pub Date
2017-01-07  
Published
2009-03-14  
Modified Date
2010-08-21  
Seq
2009-0582  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
240115 47911 CVE-2009-0582 SUSE-SR:2009:010  View
240116 47911 CVE-2009-0582 [release-team] 20090312 Another Evolution-Data-Server freeze break  View
240117 47911 CVE-2009-0582 oval:org.mitre.oval:def:10081  View
240118 47911 CVE-2009-0582 1021845  View
240119 47911 CVE-2009-0582 DSA-1813  View
240120 47911 CVE-2009-0582 MDVSA-2009:078  View
240121 47911 CVE-2009-0582 RHSA-2009:0354  View
240122 47911 CVE-2009-0582 RHSA-2009:0355  View
240123 47911 CVE-2009-0582 RHSA-2009:0358  View
240124 47911 CVE-2009-0582 34109  View
240125 47911 CVE-2009-0582 ADV-2009-0716  View
240126 47911 CVE-2009-0582 evolution-ntlmsasl-info-disclosure(49233)  View
240127 47911 CVE-2009-0582 https://bugzilla.redhat.com/show_bug.cgi?id=487685  View
240128 47911 CVE-2009-0582 FEDORA-2009-2784  View
240129 47911 CVE-2009-0582 FEDORA-2009-2792  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40486 JVNDB-2009-001492 Evolution Data Server (別名 evolution-data-server) の ntlm_challenge 関数におけるプロセスメモリ情報の漏洩またはサービス運用妨害 (DoS) の脆弱性 Evolution Data Server (別名 evolution-data-server) の Camel に含まれる NTLM SASL 認証機能の ntlm_challenge 関数 (camel/camel-sasl-ntlm.c) には、チャレンジパケットのデータ量と長さを指定している値とが一致しているか検証しないため、プロセスメモリ情報の漏洩、またはサービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2009-0582 38013 CVE-2009-0582 47911 5.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001492.html 2009-03-14 2010-05-14 View