oss-security - Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 14 May 2008 15:27:05 +0200
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution

Hi Robert,
* Robert Buchholz <rbu@...too.org> [2008-05-14 02:50]:
> On Monday, 12. May 2008, Nico Golde wrote:
> > * Robert Buchholz <rbu@...too.org> [2008-05-12 19:05]:
> > > On Monday, 12. May 2008, Nico Golde wrote:
[...] 
> > > > The same applies to emacs22.
> > >
> > > Our emacs maintainer said version 22 would warn you that lisp code
> > > from the file would be executed. Could you confirm otherwise?
> >
> > At least not with the emacs22 installation I tried this with (22.2).
> > As this is a rather old version, this may depend on the
> > version used?
> 
> The 22.2 is only a few weeks old, is it not?

Ups sorry, my bad.

> Anyway, Ulrich Mueller (who is in CC) clarified the behaviour, I quote:
> 
> > the issue may still occur in Emacs 22, if both of the following
> > conditions are fulfilled:
> > - the user sets fast-lock-mode as support mode for font-lock (which is
> >   not the default),
> > - the user explicitely loads fast-lock, ignoring the warning ("Package
> >   fast-lock is obsolete").
> 
> I could not reproduce the issue in Emacs 22.2 with only the changed 
> configuration either, but maybe I just used Emacs the wrong way.

As I am a vim user I might have done something wrong too, 
not sure. What I did after installing emacs:
cat >> ~/.emacs << EOF
(global-font-lock-mode t)
(seq font-lock-support-mode 'fast-lock-mode)
EOF

cat >> foobar.c << EOF
/* no comment */
EOF

cat >> foobar.c.flc << EOF
" foobar "
EOF

starting emacs22, open foobar.c => no warning.

Could someone on the list who is an emacs user try this as 
well?

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.