GNU bug report logs - #28350
CVE-2017-14482: enriched.el code execution

Previous Next

Full log

Message #45 received at 28350 <at> debbugs.gnu.org (full text, mbox):

From: charles <at> aurox.ch (Charles A. Roelli)
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: larsi <at> gnus.org, 28350 <at> debbugs.gnu.org
Subject: Re: enriched.el code execution
Date: Sun, 10 Sep 2017 20:54:13 +0200

> From: Paul Eggert <eggert <at> cs.ucla.edu>
> Date: Sat, 9 Sep 2017 15:43:30 -0700
> 
> Thanks for reporting this bug. Since it is a serious security hole I have 
> installed a patch by Lars Ingebrigtsen that temporarily disables the problematic 
> translations, and that also changes Gnus to not call enriched-decode. For the 
> emacs-25 branch the patch is here:
> 
> https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70
> 
> and for the master branch the patch is here:
> 
> https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=19584f13b1e2e4a778602a8302619ef5c675e68b
> 
> As this patch is merely a workaround to close the security hole, I am not 
> marking the underlying bug as fixed.
> 
> Thank you for reporting the problem.

Thanks for these fixes.  I have some comments:

> branch: master
> commit 19584f13b1e2e4a778602a8302619ef5c675e68b
> Author: Lars Ingebrigtsen <larsi <at> gnus.org>
> Commit: Paul Eggert <eggert <at> cs.ucla.edu>
>
> [...]
>
> --- a/lisp/textmodes/enriched.el
> +++ b/lisp/textmodes/enriched.el
> @@ -117,12 +117,7 @@ expression, which is evaluated to get the string to insert.")
>  		   (full        "flushboth")
>  		   (center      "center"))
>      (PARAMETER     (t           "param")) ; Argument of preceding annotation
> -    ;; The following are not part of the standard:
> -    (FUNCTION      (enriched-decode-foreground "x-color")
> -		   (enriched-decode-background "x-bg-color")

Do we know that "x-color" and/or "x-bg-color" are vulnerable to a
similar misuse as "x-display"?  If not, I can still re-add them at a
later time.

> branch: emacs-25
> commit b6389930146882a77c22901a4357e287826fc7ff
> Author: Paul Eggert <eggert <at> cs.ucla.edu>
> Commit: Paul Eggert <eggert <at> cs.ucla.edu>
>
> [...]
>
> +** Enriched text mode no longer supports the 'FUNCTION' and 'display'
> +translations, and Gnus no longer processes enriched text when
> +inlining.  This fixes bugs introduced in Emacs 19.29.  To work around
> +these bugs in Emacs versions 19.29 through 25.2, append the following
> +to your ~/.emacs file:
> +
> +  (provide 'enriched)
> +  (defun enriched-mode (&optional arg))
> +  (defun enriched-decode (from to))

This fix is very safe, at the cost of disabling Enriched mode.  Could
we do any better?  I had suggested the following (in
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350#16):

  (eval-after-load "enriched"
    '(defun enriched-decode-display-prop (start end &optional param)
       (list start end)))

But it may not work in Emacs earlier than 23 (I can't test it).

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.