bugtraq - gnome evolution mail client inline text file DoS issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1026174154.18112.19.camel@hatless-cat>
Date: Mon, 08 Jul 2002 20:22:34 -0400
From: Mike Davis <phar@...nedcoder.org>
To: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org, ntbugtraq@...ugtraq.com,
	full-disclosure@...ts.grok.org.uk
Subject: gnome evolution mail client inline text file DoS
	issue

i admit, i posted this bug just a short while ago, but since its an
anoyance more then a vuln.. i dont really care.. be glad i didnt demo it
here :) (for evolution users anyway)

so the issue is with text based file attachments with the
"Content-Disposition" set to  "inline".. if this text file contains a
single line of excessive length.. evolution dies.. even worse, ive had
this take down my X server during testing but i cant reproduce it
reliably. but im sure someone else will.

another unfortunate feature of evoltion is that it will reopen to the
message that crashed it when restarting after the crash.. pretty much
making evolution unusable untill you clean the damn message out of your
inbox (not to mention your local cache)... oh and dont think your faster
by trying to click another message while evoltion loads.. this seems to
increase the odds of killing your X server..

so, to try this out yourself, first create an email attachment that
evolution doesnt mind displaying inline..

perl -e 'printf "A"x40000' > evolution-dos-poc.xml

attach the file, suggest inline display of the xml file, and send to an
unfortunate bastard^H^H^H^H^H^H^H friend who happens to run evolution..

im not sure how to work around this in the short run, sorry guys.
it might almost be worth having an option to disable the auto display of
inlined files..

enjoy
-phar

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/