#2009-013 yTNEF/Evolution TNEF attachment decoder input sanitization errors
yTNEF, an open source filter program that decodes Transport Neutral
Encapsulation Format (TNEF) e-mail attachments, and the Evolution TNEF
attachment decoder plugin suffer from directory traversal and buffer overflow
The vulnerabilities lead to arbitrary code execution with the privilege of the
target user running the decoders.
The directory traversal vulnerability is caused by improper sanitization of the
file name used for saving the attachments, as it is computed directly from
properties contained in the TNEF structure without checking for conditions that
allow to traverse outside the temporary directory used for attachment storage.
This leads to arbitrary code execution in case the attacker crafts an
attachment that would overwrite a file used for execution (as an example the
Additionally buffer and heap overflow vulnerabilities can be triggered by
passing a file name exceeding a fixed size of 256 bytes in the TNEF data
structure. This can lead to arbitrary code execution if exploited.
yTNEF, all versions
Evolution TNEF plugin, all versions
Evolution TNEF plugin, N/A
Credit: vulnerability report and PoC code received from Yorick Koster < yorick
[at] akitasecurity [dot] nl >.
2009-07-09: vulnerability report received
2009-07-10: contacted ytnef and evolution maintainers
2009-07-11: former evolution plugin maintainer communicates that code is
unmaintained, voluntarily deletes online copy
2009-07-21: contacted affected vendors, advising to remove or disable the
2009-09-05: advisory release
Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"