GNU bug report logs - #28350
CVE-2017-14482: enriched.el code execution

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#28350: closed (CVE-2017-14482: enriched.el code execution)
Date: Sat, 16 Sep 2017 09:50:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Sat, 16 Sep 2017 12:48:58 +0300
with message-id <83a81vkm7p.fsf <at> gnu.org>
and subject line Re: bug#28350: enriched.el code execution
has caused the debbugs.gnu.org bug report #28350,
regarding CVE-2017-14482: enriched.el code execution
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
28350: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: charles <at> aurox.ch (Charles A. Roelli)
To: bug-gnu-emacs <at> gnu.org
Subject: enriched.el code execution
Date: Mon, 04 Sep 2017 21:24:42 +0200

[Message part 3 (text/plain, inline)]

Enriched mode implements an extension command to the text/enriched
format called "x-display", which stores "display" text properties.
It was added awhile ago:

  commit d9e28c1ca1d95f51a05d052dcf1fe06888d52476
  Author: Gerd Moellmann <gerd <at> gnu.org>
  Date:   Wed Jul 21 21:43:03 1999 +0000

  (enriched-translations): Add `display' and "x-display".
  (enriched-handle-display-prop): New.
  (enriched-decode-display-prop): New.

It's possible to use this extension command to transparently execute
arbitrary code in an Emacs process that opens a text/enriched file.
For example, if you open a file containing the following contents:

Content-Type: text/enriched
Text-Width: 70

<x-display><param>(when (message "hello world") nil)</param>test</x-display>

Then "hello world" will be printed in the echo area whenever the
"test" text is displayed (which is immediate).  Note that the
s-expression between the <param> tags needs to conform to a "display"
spec: but since there are a few display specs that can execute code,
it's not difficult to craft a file that could have bad effects (shell
commands work, for example).  Additionally, such a file can be
compressed with gzip (thus hiding the contents), and when it is
opened, Emacs will automatically decompress it and apply the display
properties.  Attached is an example file (enriched-bug-example.txt)
that turns the mode line red as soon as you open it.  It works in
23.4, 24.5, 25.2 and master (and possibly earlier versions -- I
haven't tested).

Other extensions in `enriched-translations' of enriched.el may have
similar issues (I don't understand them all, so I hope somebody else
can make sure).

[enriched-bug-example.txt (text/enriched, attachment)]

[Message part 5 (message/rfc822, inline)]

From: Eli Zaretskii <eliz <at> gnu.org>
To: charles <at> aurox.ch, larsi <at> gnus.org
Cc: eggert <at> cs.ucla.edu, 28350-done <at> debbugs.gnu.org
Subject: Re: bug#28350: enriched.el code execution
Date: Sat, 16 Sep 2017 12:48:58 +0300

> Date: Mon, 11 Sep 2017 22:07:26 +0300
> From: Eli Zaretskii <eliz <at> gnu.org>
> Cc: larsi <at> gnus.org, eggert <at> cs.ucla.edu, 28350 <at> debbugs.gnu.org
> 
> > Date: Mon, 11 Sep 2017 20:44:19 +0200
> > From: charles <at> aurox.ch (Charles A. Roelli)
> > CC: eggert <at> cs.ucla.edu, larsi <at> gnus.org, 28350 <at> debbugs.gnu.org
> > 
> > > Here's the idea: we introduce a new form of a display property:
> > > 
> > >   ('disable-eval SPEC)
> > > 
> > > where SPEC is anything supported in a display property.
> > 
> > Thanks for suggesting this; it's much cleaner than sanitizing the
> > display specification from Lisp.  Looks good to me.
> 
> Thanks, I will wait for a few days before pushing.

Done.

Lars, I re-enabled support for enriched text in Gnus, as the
vulnerability is now removed.  Feel free to disable it again, if you
don't want Gnus users to be able to display enriched text, ever.

I'm marking the bug done.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.