GNU Emacs Predictable temporary filenames

2014.05.08
Credit: Steve
Risk: Medium
Local: Yes
Remote: No
CWE: N/A

I reported these bugs on the Debian tracker on Monday: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747100 In brief some of the bundled Emacs Lisp uses predictable /tmpfile names insecurely: lisp/gnus/gnus-fun.el: In the function `gnus-grab-cam-face` the file "/tmp/gnus.face.ppm" is used, blindly allowing the existing file to be truncated, and symlinks followed. lisp/emacs-lisp/find-gc.el: In the function `trace-call-tree` there are some horrific invocations of the csh, which manipulate the directory and symlinks beneath "/tmp/esrc". lisp/net/tramp.el The function `tramp-uudecode`, a fallback if a real uudecoding binary is not present, blindly uses "/tmp/tramp.$PID", truncating and removing the file. All these have been fixed now, and the GNU bug report contains links to the commits that are appropriate: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428 Steve -- http://www.steve.org.uk/

Referencje:

http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747100


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top