GNU Emacs vcdiff Unsafe Temporary File Lets Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1019909
|
|
SecurityTracker URL: http://securitytracker.com/id?1019909
|
|
CVE Reference: CVE-2008-1694
(Links to External Site)
|
Date: Apr 21 2008
|
Impact: Modification of system information, Modification of user information, User access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 22.2 and prior versions
|
Description: A vulnerability was reported in GNU Emacs in the vcdiff script. A local user can obtain elevated privileges on the target system.
The vcdiff script uses a temporary file with a predictable filename. A local user can create a symbolic link (symlink) from a file
on the system to a temporary file to be used by vcdiff. Then, when the target user invokes the vcdiff script, the symlinked file
will be written to with the privileges of the target user.
A local user may be able to exploit this to gain elevated privileges.
Steve
Grubb reported this vulnerability.
|
Impact: A local user can obtain elevated privileges on the target system.
|
Solution: The vendor has issued a source code fix.
|
Vendor URL: www.gnu.org/software/emacs/emacs.html (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 21 Apr 2008 07:50:00 -0400
Subject: GNU Emacs
|
https://bugzilla.redhat.com/show_bug.cgi?id=208483
> Bugzilla Bug 208483: CVE-2008-1694 emacs insecure /tmp file usage
|
|
