[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#30912: [bug-gnu-emacs] emacs as a route to privilege escalation

From: Noam Postavsky
Subject: bug#30912: [bug-gnu-emacs] emacs as a route to privilege escalation
Date: Thu, 22 Mar 2018 20:05:01 -0400
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/26.0.90 (gnu/linux)

forcemerge 28618 30912

"Nelson H. F. Beebe" <address@hidden> writes:

> The SANS security list today carried a pointer to this Web site:
>       Abusing Text Editors with Third-party Plugins
>       March 15, 2018
>       Dor Azouri 
> https://safebreach.com/Post/Abusing-Text-Editors-with-Third-party-Plugins
> It links to an 11-page report of the same title at
>       https://go.safebreach.com/rs/535-IXZ-934/images/Abusing_Text_Editors.pdf
> Do emacs developers wish to respond to the security attacks described
> there?

Dor already brought this up in Bug#28618.  As Glenn said:

    If an attacker has [compromised] a user account that can run "sudo arbitrary
    command", then that's just the same as having compromised the root
    account, and so worrying about this on the individual application level
    doesn't seem to make sense. Eg they could replace "sudo" with a keylogger.

Note that the problem could be "fixed" by setting

    Defaults always_set_home

in /etc/sudoers (Debian has this setting by default), but that won't
help with the sudo-is-a-key-logger problem.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]