Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2174
Evolution Data Server vulnerability
27 July 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: evolution-data-server
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2016-10727
Reference: ESB-2018.2165
Original Bulletin:
https://usn.ubuntu.com/usn/usn-3724-1
- --------------------------BEGIN INCLUDED TEXT--------------------
==========================================================================
Ubuntu Security Notice USN-3724-1
July 26, 2018
evolution-data-server vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- - Ubuntu 16.04 LTS
- - Ubuntu 14.04 LTS
Summary:
Evolution Data Server could be made to expose sensitive information over the
network.
Software Description:
- - evolution-data-server: Evolution suite data server
Details:
Jon Kristensen discovered that Evolution Data Server would automatically
downgrade a connection to an IMAP server if the IMAP server did not support
SSL. This would result in the user's password being unexpectedly sent in clear
text, even though the user had requested to use SSL.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
evolution-data-server 3.18.5-1ubuntu1.1
evolution-data-server-common 3.18.5-1ubuntu1.1
libcamel-1.2-54 3.18.5-1ubuntu1.1
libebackend-1.2-10 3.18.5-1ubuntu1.1
libedataserver-1.2-21 3.18.5-1ubuntu1.1
Ubuntu 14.04 LTS:
evolution-data-server 3.10.4-0ubuntu1.6
evolution-data-server-common 3.10.4-0ubuntu1.6
libcamel-1.2-45 3.10.4-0ubuntu1.6
libebackend-1.2-7 3.10.4-0ubuntu1.6
libedataserver-1.2-18 3.10.4-0ubuntu1.6
After a standard system update you need to restart Evolution to make
all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3724-1
CVE-2016-10727
Package Information:
https://launchpad.net/ubuntu/+source/evolution-data-server/3.18.5-1ubuntu1.1
https://launchpad.net/ubuntu/+source/evolution-data-server/3.10.4-0ubuntu1.6
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW1pmf2aOgq3Tt24GAQj7og/9GvC9ckBtI0wysxsoX61MqjKpcaM8aKsx
CBvWRfojx2y4gh/iZzTZ+O34qcxm/8Vf//hHJaag7vw6dfwmZeFQ5qRboZW4DUuD
NMv1sQzBW6JVCtY+twqA+nlr6Ow1yfBsMBN6UcjkzcKFujdxWfVM/8kzuhZdJ/P7
Psq7QqlmYncGJ9+61D15uPcoEkgpGBTfJDV8ZQVcjzJ1VueaVr9z9j0r2QwS9BbR
Sr9pvI+1y3Y+Gdy303GL2YxxQ3fhvOr1emL/z1UdnRsyEpcxnuoWkPJ6RxPQ4vLZ
Pme/Rq63aTS/QOV7LD3S8reHU0/mqmqvnhHLGbB2mrqNbn+LxyKWAS5rLTTJtIAE
bHLeLYMOo0Zp4F4KDe9OaGqXOC1Wwn1Mpo30W5WGkZv5t4V3AhbdhXp3nmxUbVue
wDVbATZlhgrFyhKWRki0mzKwA7ishtAje9MASu7C5EEZBGJS+DgH6+QiiJrYH2Xs
Sk9VagXNJg5wZdzyY80wkJzlmSSLODQKJuHpnoVOTknlh+YJX45yN2qi51g+uaVF
MIKaHeX7u3URm1r5ndLDIP2K9GjJdzda3mVMp/8dpARAoCJXHhCO+JNGwYZTYLz9
epyF+vp0XCRch2B6NtLYyYCszOAPoqFOrwKX8zLNFmpGBubMZXe5C3hcpqA1Xyqz
1d3rhLi4BEw=
=mLBW
-----END PGP SIGNATURE-----