Vulnerabilities > CVE-2012-3479 - Remote Code Execution vulnerability in GNU Emacs 'enable-local-variables'
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 4 |
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2012-710.NASL description This update fixes the following issues for emacs, emacs-w3, gnuplot and ddskk: emacs : - Add fix for bnc#775993 which disable arbitrary lisp code execution when last seen 2020-06-05 modified 2014-06-13 plugin id 74780 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74780 title openSUSE Security Update : emacs and depending packages (openSUSE-SU-2012:1348-1) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2013-076.NASL description Updated emacs packages fix security vulnerabilities : Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file (CVE-2012-0035). lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file (CVE-2012-3479). Additionally a problem was fixed reading xz compressed files (mga#7759). last seen 2020-06-01 modified 2020-06-02 plugin id 66090 published 2013-04-20 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/66090 title Mandriva Linux Security Advisory : emacs (MDVSA-2013:076) NASL family Fedora Local Security Checks NASL id FEDORA_2012-11876.NASL description CVE-2012-3479 emacs: Evaluation of last seen 2020-03-17 modified 2012-08-23 plugin id 61634 published 2012-08-23 reporter This script is Copyright (C) 2012-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/61634 title Fedora 17 : emacs-24.1-4.fc17 (2012-11876) NASL family Solaris Local Security Checks NASL id SOLARIS11_EMACS_20140731.NASL description The remote Solaris system is missing necessary patches to address security updates : - lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file. (CVE-2012-3479) last seen 2020-06-01 modified 2020-06-02 plugin id 80603 published 2015-01-19 reporter This script is Copyright (C) 2015-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/80603 title Oracle Solaris Third-Party Patch Update : emacs (cve_2012_3479_arbitrary_code) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201403-05.NASL description The remote host is affected by the vulnerability described in GLSA-201403-05 (GNU Emacs: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in GNU Emacs: When ‘global-ede-mode’ is enabled, EDE in Emacs automatically loads a Project.ede file from the project directory (CVE-2012-0035). When ‘enable-local-variables’’ is set to ‘:safe’, Emacs automatically processes eval forms (CVE-2012-3479). Impact : A remote attacker could entice a user to open a specially crafted file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 73127 published 2014-03-21 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/73127 title GLSA-201403-05 : GNU Emacs: Multiple vulnerabilities NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_C1E5F35EF93D11E1B07F00235A5F2C9A.NASL description Chong Yidong reports : Paul Ling has found a security flaw in the file-local variables code in GNU Emacs. When the Emacs user option `enable-local-variables last seen 2020-06-01 modified 2020-06-02 plugin id 62023 published 2012-09-10 reporter This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/62023 title FreeBSD : emacs -- remote code execution vulnerability (c1e5f35e-f93d-11e1-b07f-00235a5f2c9a) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2012-228-02.NASL description New emacs packages are available for Slackware 13.1, 13.37, and -current to fix a security issue. last seen 2020-06-01 modified 2020-06-02 plugin id 61553 published 2012-08-16 reporter This script is Copyright (C) 2012-2014 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/61553 title Slackware 13.1 / 13.37 / current : emacs (SSA:2012-228-02) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1586-1.NASL description Hiroshi Oota discovered that Emacs incorrectly handled search paths. If a user were tricked into opening a file with Emacs, a local attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. (CVE-2012-0035) Paul Ling discovered that Emacs incorrectly handled certain eval forms in local-variable sections. If a user were tricked into opening a specially crafted file with Emacs, a remote attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. (CVE-2012-3479). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 62365 published 2012-09-28 reporter Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/62365 title Ubuntu 11.10 / 12.04 LTS : emacs23 vulnerabilities (USN-1586-1) NASL family Fedora Local Security Checks NASL id FEDORA_2012-11872.NASL description CVE-2012-3479 emacs: Evaluation of last seen 2020-03-17 modified 2012-08-23 plugin id 61633 published 2012-08-23 reporter This script is Copyright (C) 2012-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/61633 title Fedora 16 : emacs-23.3-10.fc16 (2012-11872) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2603.NASL description Paul Ling discovered that Emacs insufficiently restricted the evaluation of Lisp code if enable-local-variables is set to last seen 2020-03-17 modified 2013-01-10 plugin id 63456 published 2013-01-10 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63456 title Debian DSA-2603-1 : emacs23 - programming error
References
- http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00057.html
- http://secunia.com/advisories/50157
- http://secunia.com/advisories/50801
- http://www.debian.org/security/2013/dsa-2603
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:076
- http://www.openwall.com/lists/oss-security/2012/08/13/1
- http://www.openwall.com/lists/oss-security/2012/08/13/2
- http://www.securityfocus.com/bid/54969
- http://www.securitytracker.com/id?1027375
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.420006
- http://www.ubuntu.com/usn/USN-1586-1