Bug 578267 (CVE-2010-0825)

Summary: CVE-2010-0825 emacs, xemacs: Race condition by moving message from user's inbox into user's Rmail file, when movemail setgid enabled
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bressers, dnovotny, jrusnack, kklic
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: https://bugs.launchpad.net/ubuntu/+source/emacs22/+bug/531569
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-04-06 18:38:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 578272, 578273    
Bug Blocks:    

Description Jan Lieskovsky 2010-03-30 18:09:49 UTC
Dan Rosenberg found a race condition in the Emacs's Rmail
subsystem, when moving mail from user's inbox into user's
Rmail file. A local attacker could use this flaw to conduct
symlink attacks on the mailbox of the targeted user, leading
to possibility to read or alter mail of the victim.

References:
  [1] https://bugs.launchpad.net/ubuntu/+source/emacs22/+bug/531569
  [2] http://www.ubuntu.com/usn/USN-919-1

Flaw exploitability note:
  In order the above attack scenario to succeed, the Emacs / Xemacs
movemail binary would need to be equipped with the setgid attribute.
This is NOT the case for versions of emacs and xemacs packages,
as shipped within various Red Hat products.

Comment 4 Jan Lieskovsky 2010-03-30 18:23:24 UTC
This issue does NOT affect the versions of the emacs package, as shipped
with Red Hat Enterprise Linux 3, 4, and 5.

The Emacs movemail binary, responsible for moving email messages
from user's inbox into user's Rmail file is NOT equipped with
setgid attribute (which is required for this flaw to succeed) in
the versions of emacs package, as shipped with Red Hat Enterprise
Linux 3, 4, and 5.

--

This issue does NOT affect the versions of the xemacs package, as shipped
with Red Hat Enterprise Linux 3 and 4.

The Xemacs movemail binary, responsible for moving email messages
from user's inbox into user's Rmail file is NOT equipped with
setgid attribute (which is required for this flaw to succeed) in
the versions of xemacs package, as shipped with Red Hat Enterprise
Linux 3 and 4.

--

This issue does NOT affect the versions of the emacs package, as shipped
with Fedora release of 11 and 12.

The Emacs movemail binary, responsible for moving email messages
from user's inbox into user's Rmail file is NOT equipped 
with setgid attribute (which is required for this flaw to succeed) 
in the versions of emacs package, as shipped with Fedora releases
of 11 and 12.

--

This issue does NOT affect the versions of the xemacs package, as shipped
with Fedora release of 11 and 12.

The Xemacs movemail binary, responsible for moving email messages
from user's inbox into user's Rmail file is NOT equipped
with setgid attribute (which is required for this flaw to succeed)
in the versions of the xemacs package, as shipped with Fedora 
releases of 11 and 12.

Comment 10 Fedora Update System 2010-04-01 18:41:31 UTC
emacs-23.1-13.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/emacs-23.1-13.fc11

Comment 11 Fedora Update System 2010-04-01 18:41:40 UTC
emacs-23.1.94-2.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/emacs-23.1.94-2.fc13

Comment 12 Fedora Update System 2010-04-01 18:41:46 UTC
emacs-23.1-21.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/emacs-23.1-21.fc12

Comment 14 Josh Bressers 2010-04-06 18:38:20 UTC
I'm closing this issue as NOTABUG. No versions of emacs have the setgid bit set on the movemail utility. Without this bit set, the flaw does not exist.

See Comment 4 for more details.

Comment 15 Fedora Update System 2010-04-20 13:09:00 UTC
emacs-23.1-13.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2010-04-20 13:30:27 UTC
emacs-23.1-21.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.