GNU Emacs Temporary File Creation Vulnerability
BID:1126
Info
GNU Emacs Temporary File Creation Vulnerability
| Bugtraq ID: | 1126 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 18 2000 12:00AM |
| Updated: | Apr 18 2000 12:00AM |
| Credit: | This vulnerability was announced in a RUS-Cert advisory on April 18, 2000. |
| Vulnerable: |
GNU Emacs 20.6 GNU Emacs 20.5 GNU Emacs 20.4 GNU Emacs 20.3 GNU Emacs 20.2 GNU Emacs 20.1 GNU Emacs 20.0 |
| Not Vulnerable: | |
Discussion
GNU Emacs Temporary File Creation Vulnerability
A vulnerability exists in Emacs 20, from GNU. Current versions of Emacs are incapable of securely creating temporary files from emacs-lisp. File names are predictable, and will follow existing symlinks. This would allow for a myriad of attacks, from overwriting files, to gaining access to any Emacs user's account.
A vulnerability exists in Emacs 20, from GNU. Current versions of Emacs are incapable of securely creating temporary files from emacs-lisp. File names are predictable, and will follow existing symlinks. This would allow for a myriad of attacks, from overwriting files, to gaining access to any Emacs user's account.
Exploit / POC
GNU Emacs Temporary File Creation Vulnerability
To exploit this vulnerability, one would simply need to observe the creation of temporary files in /tmp, note the pattern, and create symbolic links to alternate files on the filesystem. For instance, one could create a symbolic link to ~usertoattack/.rhosts, and gain access to that account.
To exploit this vulnerability, one would simply need to observe the creation of temporary files in /tmp, note the pattern, and create symbolic links to alternate files on the filesystem. For instance, one could create a symbolic link to ~usertoattack/.rhosts, and gain access to that account.
Solution / Fix
GNU Emacs Temporary File Creation Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
It has been indicated that this problem will not be suitably fixed until Emacs 21. A temporary solution is to define alternate temporary directories for modes which use temporary files. This is defined on a per-module basis.
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
It has been indicated that this problem will not be suitably fixed until Emacs 21. A temporary solution is to define alternate temporary directories for modes which use temporary files. This is defined on a per-module basis.
References
GNU Emacs Temporary File Creation Vulnerability
References:
References: