Novell Evolution Unspecified Denial of Service Vulnerability

BID:12826

Info

Novell Evolution Unspecified Denial of Service Vulnerability

Bugtraq ID: 12826
Class: Failure to Handle Exceptional Conditions
CVE: CVE-2005-0806
Remote: Yes
Local: No
Published: Mar 17 2005 12:00AM
Updated: Jul 12 2009 10:56AM
Credit: Reported by cantona <[email protected]>.
Vulnerable: Novell Evolution 2.0.3
+ Mandriva Linux Mandrake 10.1 x86_64
 + Mandriva Linux Mandrake 10.1
Novell Evolution 2.0.2
+ MandrakeSoft Corporate Server 3.0 x86_64
 + MandrakeSoft Corporate Server 3.0
+ Mandriva Linux Mandrake 10.1 x86_64
 + Mandriva Linux Mandrake 10.1
+ Mandriva Linux Mandrake 10.0 AMD64
 + Mandriva Linux Mandrake 10.0
+ Redhat Desktop 4.0
+ Redhat Enterprise Linux AS 4
 + Redhat Enterprise Linux ES 4
 + Redhat Enterprise Linux WS 4
 + S.u.S.E. Linux Personal 9.2
+ S.u.S.E. Linux Personal 9.1
+ S.u.S.E. Linux Personal 9.0 x86_64
 + S.u.S.E. Linux Personal 9.0
+ S.u.S.E. Linux Personal 8.2
+ SuSE Linux 8.1
+ SuSE Linux 8.0 i386
 + SuSE Linux 8.0
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32
Not Vulnerable: Novell Evolution 2.0.4

Discussion

Novell Evolution Unspecified Denial of Service Vulnerability

Evolution is vulnerable to a remotely exploitable denial of service condition related to processing of messages with malformed unicode specifications. Messages with certain properties can cause a failure that will force the client to crash when the message is processed. The denial of service may persist until the message is manually removed from the mail archive. Usenet posts may be an ideal vector for a passive attack against unsuspecting readers.

Exploit / POC

Novell Evolution Unspecified Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] &lt;mailto:[email protected]&gt;.

Solution / Fix

Novell Evolution Unspecified Denial of Service Vulnerability

Solution:
MandrakeSoft has issued patches in advisory MDKSA-2005:059. See reference section.

The vendor has released version 2.0.4 dealing with this issue.

Conectiva Linux has released advisory CLA-2005:950 along with fixes dealing with this issue. Please see the referenced advisory for more information.


Novell Evolution 2.0.2

Novell Evolution 2.0.3

References

Novell Evolution Unspecified Denial of Service Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report