CVE-2012-3479 emacs: Evaluation of 'eval' forms in file-local variable sections, when 'enable-local-variables' set to ':safe'

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Hiroshi Oota discovered that Emacs incorrectly handled search paths.
If a user were tricked into opening a file with Emacs, a local attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. (CVE-2012-0035)

Paul Ling discovered that Emacs incorrectly handled certain eval forms in local-variable sections. If a user were tricked into opening a specially crafted file with Emacs, a remote attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. (CVE-2012-3479).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201403-05 (GNU Emacs: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GNU Emacs:
      When &lsquo;global-ede-mode&rsquo; is enabled, EDE in Emacs automatically         loads a Project.ede file from the project directory (CVE-2012-0035).
      When &lsquo;enable-local-variables&rsquo;&rsquo; is set to &lsquo;:safe&rsquo;, Emacs         automatically processes eval forms (CVE-2012-3479).
  Impact :

    A remote attacker could entice a user to open a specially crafted file,       possibly resulting in execution of arbitrary code with the privileges of       the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update fixes the following issues for emacs, emacs-w3, gnuplot and ddskk: emacs :

  - Add fix for bnc#775993 which disable arbitrary lisp code     execution when 'enable-local-variables' is set to     ':safe' (CVE-2012-3479)

  - Add fix for bnc#780653 to allow emacs to parse tar     archives with PAX extended headers

  - This update also upgrades emacs to version 24.1 :

  - Support for Gtk+3.0, GnuTLS, ImageMagick, libxml2, and     SELinux

  - Support for wide integer (62 bits) in lisp even on     32-bit machines.

  - The --unibyte, --multibyte, --no-multibyte, and
    --no-unibyte command line arguments, and the     EMACS_UNIBYTE environment variable, no longer have any     effect.

  - And many more changes see /usr/share/emacs/24.1/etc/NEWS

  - Remove obsolete patches

  - Refresh some others patches

emacs-w3 :

  - (condition-case ...) and (eval-when (compile) ...) will     not work together

gnuplot :

  - Resolve the former problem by using texlive-texinfo to     enforce installing required fonts as well as required     tools for TL 2012

  - add more texlive 2012 requirements

  - Make it build with latest TeXLive 2012 with new package     layout 

  - Convert gnuplot.el to new backtick lisp scheme for emacs     24.1

ddskk :

  - Update to ddskk-14.4 and skkdic-20110529

  - Take some patches from Debian as well add some own     patches

  - Drop superfluous patches

New emacs packages are available for Slackware 13.1, 13.37, and
-current to fix a security issue.

Chong Yidong reports :

Paul Ling has found a security flaw in the file-local variables code in GNU Emacs.

When the Emacs user option `enable-local-variables' is set to `:safe' (the default value is t), Emacs should automatically refuse to evaluate `eval' forms in file-local variable sections. Due to the bug, Emacs instead automatically evaluates such `eval' forms. Thus, if the user changes the value of `enable-local-variables' to `:safe', visiting a malicious file can cause automatic execution of arbitrary Emacs Lisp code with the permissions of the user.

The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.

Paul Ling discovered that Emacs insufficiently restricted the evaluation of Lisp code if enable-local-variables is set to 'safe'.

Updated emacs packages fix security vulnerabilities :

Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file (CVE-2012-0035).

lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file (CVE-2012-3479).

Additionally a problem was fixed reading xz compressed files (mga#7759).

The remote Solaris system is missing necessary patches to address security updates :

  - lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1     automatically executes eval forms in local-variable     sections when the enable-local-variables option is set     to :safe, which allows user-assisted remote attackers to     execute arbitrary Emacs Lisp code via a crafted file.
    (CVE-2012-3479)

ID	Name	Product	Family	Published	Updated	Severity
61633	Fedora 16 : emacs-23.3-10.fc16 (2012-11872)	Nessus	Fedora Local Security Checks	8/23/2012	1/11/2021	medium
62365	Ubuntu 11.10 / 12.04 LTS : emacs23 vulnerabilities (USN-1586-1)	Nessus	Ubuntu Local Security Checks	9/28/2012	9/19/2019	high
73127	GLSA-201403-05 : GNU Emacs: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	3/21/2014	1/6/2021	high
74780	openSUSE Security Update : emacs and depending packages (openSUSE-SU-2012:1348-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	medium
61553	Slackware 13.1 / 13.37 / current : emacs (SSA:2012-228-02)	Nessus	Slackware Local Security Checks	8/16/2012	1/14/2021	medium
62023	FreeBSD : emacs -- remote code execution vulnerability (c1e5f35e-f93d-11e1-b07f-00235a5f2c9a)	Nessus	FreeBSD Local Security Checks	9/10/2012	1/6/2021	medium
63456	Debian DSA-2603-1 : emacs23 - programming error	Nessus	Debian Local Security Checks	1/10/2013	1/11/2021	medium
61634	Fedora 17 : emacs-24.1-4.fc17 (2012-11876)	Nessus	Fedora Local Security Checks	8/23/2012	1/11/2021	medium
66090	Mandriva Linux Security Advisory : emacs (MDVSA-2013:076)	Nessus	Mandriva Local Security Checks	4/20/2013	1/6/2021	high
80603	Oracle Solaris Third-Party Patch Update : emacs (cve_2012_3479_arbitrary_code)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

high

high

medium

medium

medium

medium

medium

high

medium