oss-security - Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 14 May 2008 02:39:36 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Cc: Ulrich Mueller <ulm@...too.org>
Subject: Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution

Hey Nico,

On Monday, 12. May 2008, Nico Golde wrote:
> * Robert Buchholz <rbu@...too.org> [2008-05-12 19:05]:
> > On Monday, 12. May 2008, Nico Golde wrote:
> > > * Robert Buchholz <rbu@...too.org> [2008-05-10 15:01]:
> > > > Emacs 21 and Xemacs will execute any lisp code present in a .flc
> > > > file that accompanies the file the user opens.
> > >
> > > The same applies to emacs22.
> >
> > Our emacs maintainer said version 22 would warn you that lisp code
> > from the file would be executed. Could you confirm otherwise?
>
> At least not with the emacs22 installation I tried this with (22.2).
> As this is a rather old version, this may depend on the
> version used?

The 22.2 is only a few weeks old, is it not?

Anyway, Ulrich Mueller (who is in CC) clarified the behaviour, I quote:

> the issue may still occur in Emacs 22, if both of the following
> conditions are fulfilled:
> - the user sets fast-lock-mode as support mode for font-lock (which is
>   not the default),
> - the user explicitely loads fast-lock, ignoring the warning ("Package
>   fast-lock is obsolete").

I could not reproduce the issue in Emacs 22.2 with only the changed 
configuration either, but maybe I just used Emacs the wrong way.


Robert

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.