[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Symlink attack vulnerability in auto-saving
From: |
Sven Joachim |
Subject: |
Symlink attack vulnerability in auto-saving |
Date: |
Mon, 10 Sep 2007 20:07:19 +0200 |
User-agent: |
Gnus/5.11 (Gnus v5.11) Emacs/22.1.50 (gnu/linux) |
Following the recent discussion about symlinks and race-conditions in
the thread "creating backups in temporary directories", I may have
discovered a more severe vulnerability in auto-saving of files. If a
file foobar exists, Emacs will write auto-save data to #foobar# and
follow symlinks. That's rather bad if foobar is in a world-writable
directory. :-(
In GNU Emacs 22.1.50.1 (i486-pc-linux-gnu, GTK+ Version 2.10.13)
of 2007-09-07 on debian, modified by Debian
(Debian emacs-snapshot package, version 1:20070907-1)
Windowing system distributor `The X.Org Foundation', version 11.0.10300000
configured using `configure '--build' 'i486-linux-gnu' '--host'
'i486-linux-gnu' '--prefix=/usr' '--sharedstatedir=/var/lib'
'--libexecdir=/usr/lib' '--localstatedir=/var' '--infodir=/usr/share/info'
'--mandir=/usr/share/man' '--with-pop=yes'
'--enable-locallisppath=/etc/emacs-snapshot:/etc/emacs:/usr/local/share/emacs/22.1.50/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/22.1.50/site-lisp:/usr/share/emacs/site-lisp:/usr/share/emacs/22.1.50/leim'
'--with-x=yes' '--with-x-toolkit=gtk' 'build_alias=i486-linux-gnu'
'host_alias=i486-linux-gnu' 'CFLAGS=-DDEBIAN -DSITELOAD_PURESIZE_EXTRA=5000 -g
-O2''
Important settings:
value of $LC_ALL: nil
value of $LC_COLLATE: C
value of $LC_CTYPE: nil
value of $LC_MESSAGES: nil
value of $LC_MONETARY: nil
value of $LC_NUMERIC: nil
value of $LC_TIME: nil
value of $LANG: de_DE.UTF-8
locale-coding-system: utf-8
default-enable-multibyte-characters: t
Major mode: Help
Minor modes in effect:
shell-dirtrack-mode: t
display-time-mode: t
auto-image-file-mode: t
show-paren-mode: t
tooltip-mode: t
mouse-wheel-mode: t
menu-bar-mode: t
file-name-shadow-mode: t
global-font-lock-mode: t
font-lock-mode: t
unify-8859-on-encoding-mode: t
utf-translate-cjk-mode: t
auto-compression-mode: t
temp-buffer-resize-mode: t
column-number-mode: t
line-number-mode: t
transient-mark-mode: t
view-mode: t
Recent input:
e SPC <return> M-x <up> <return> C-x d <return> g <up>
<up> <up> <up> <up> <up> <up> <up> <up> <up> <return>
C-x k <return> <f7> <down> <return> SPC a d f r e p
ü ü ü ö ö ö ö l l l k k k <f7> <down> <return> g <return>
C-x k <return> <f7> <down> <down> <down> <return> <down>
<down> <down> <down> <down> <down> <down> <down> <down>
<down> <down> <down> <down> <down> <down> <down> <down>
<down> <down> <down> <down> <down> <down> <down> <prior>
C-x 1 <up> <up> <up> <up> <up> <up> <up> <up> <up>
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up>
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up>
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up>
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up>
<up> <up> <up> <up> <up> <down> <down> <down> <down>
<down> <down> <down> <down> <down> <down> <down> <down>
<down> <down> <down> <down> <down> <down> <down> <down>
<down> <down> <down> <down> <down> <down> <down> <down>
<down> <down> <down> <down> <down> <down> <down> <down>
<up> <up> <down> <down> <down> <right> <right> <right>
<right> <right> <right> <right> <right> <right> <right>
<right> <right> <right> <right> <right> <right> <right>
<left> <left> <right> <right> <right> <right> <right>
<right> <right> <right> <right> <right> <right> <right>
<right> <right> <right> <right> <right> <right> <right>
<right> <right> <right> <right> <right> <right> <right>
<right> <right> <right> <right> <down> <up> C-h C-g
C-u h C-z C-u a C-z C-u C-h a a u t o - s a c <backspace>
v e <return> C-x o <down> <down> <down> <down> <down>
<down> <down> <down> <down> <down> <down> <down> <down>
<down> <down> <down> <down> <return> C-x o M-x r e
p o r t - e m a c s - b u g <return>
Recent messages:
Commands: d, s, x, u; f, o, 1, 2, m, v; ~, %; q to quit; ? for help. [2 times]
Undo! [2 times]
Loading apropos...done
Type C-x 1 to remove help window.
Type C-x 4 o RET to restore the other window.
Loading emacsbug...done
mouse-2, RET: find function's definition
uncompressing files.el.gz...done
Note: file is write protected
"/usr/share/emacs/22.1.50/lisp/#files.el.gz#" [2 times]
- Symlink attack vulnerability in auto-saving,
Sven Joachim <=