bug#30912: [bug-gnu-emacs] emacs as a route to privilege escalation

[Noam Postavsky]

forcemerge 28618 30912
quit

"Nelson H. F. Beebe" <beebe@math.utah.edu> writes:

> The SANS security list today carried a pointer to this Web site:
>
>       Abusing Text Editors with Third-party Plugins
>       March 15, 2018
>       Dor Azouri 
>       
> https://safebreach.com/Post/Abusing-Text-Editors-with-Third-party-Plugins
>
> It links to an 11-page report of the same title at
>
>       https://go.safebreach.com/rs/535-IXZ-934/images/Abusing_Text_Editors.pdf
>
> Do emacs developers wish to respond to the security attacks described
> there?

Dor already brought this up in Bug#28618.  As Glenn said:

    If an attacker has [compromised] a user account that can run "sudo arbitrary
    command", then that's just the same as having compromised the root
    account, and so worrying about this on the individual application level
    doesn't seem to make sense. Eg they could replace "sudo" with a keylogger.

Note that the problem could be "fixed" by setting

    Defaults always_set_home

in /etc/sudoers (Debian has this setting by default), but that won't
help with the sudo-is-a-key-logger problem.