Bug 1490409 (CVE-2017-14482)

Summary:	CVE-2017-14482 emacs: command injection flaw within "enriched mode" handling
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	jonathan.underwood, jsynacek, msekleta, phracek, tim, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A command injection flaw within the Emacs "enriched mode" handling has been discovered. By tricking an unsuspecting user into opening a specially crafted file using Emacs, a remote attacker could exploit this flaw to execute arbitrary commands with the privileges of the Emacs user.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-09-22 08:41:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1490410, 1490451, 1490452
Bug Blocks:	1490413

Description Andrej Nemec 2017-09-11 13:40:27 UTC

Enriched mode implements an extension command to the text/enriched format called "x-display", which stores "display" text properties. It's possible to use this extension command to transparently execute arbitrary code in an Emacs process that opens a text/enriched file.

Upstream issue:

https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350

Upstream patch:

https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70

References:

http://seclists.org/oss-sec/2017/q3/422

Comment 1 Andrej Nemec 2017-09-11 13:40:58 UTC

Created emacs tracking bugs for this issue:

Affects: fedora-all [bug 1490410]

Comment 5 errata-xmlrpc 2017-09-19 18:36:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2771 https://access.redhat.com/errata/RHSA-2017:2771

Comment 6 Stefan Cornelius 2017-09-25 13:16:35 UTC

Mitigation:

This issue can be mitigated by adding the following lines to the Emacs init file (for example ~/.emacs, ~/emacs.d/init.el, site-start.el) and avoiding options that would bypass normal initialization, like 'emacs -Q':

  ;; Mitigate CVE-2017-14482 in Emacs 25.2 and earlier
(require 'enriched)
(defun enriched-decode-display-prop (start end &optional param)
  (list start end))