Red Hat Bugzilla – Bug 1095586
CVE-2014-3421 CVE-2014-3422 CVE-2014-3423 CVE-2014-3424 emacs: multiple temporary file issues
Last modified: 2015-07-31 03:20:12 EDT
Steve Kemp discovered multiple temporary file handling issues in Emacs. A local attacker could use these flaws to perform symbolic link attacks against users running Emacs. Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747100
CVE-2014-3421 was assigned to the issue in lisp/gnus/gnus-fun.el
Upstream fix: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00055.html
CVE-2014-3422 was assigned to the issue in lisp/emacs-lisp/find-gc.el
Upstream fix: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00056.html
CVE-2014-3423 was assigned to the issue in lisp/net/browse-url.el (this one does not currently have a fix)
Upstream note: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00057.html
CVE-2014-3424 was assigned to the issue in lisp/net/tramp.el
Upstream fix: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00060.html
Created emacs tracking bugs for this issue:
Affects: fedora-all [bug 1095587]
xemacs-21.5.31 did not have any of the affected files
CVE-2014-3421 CVE-2014-3422 CVE-2014-3423 CVE-2014-3424
To execute symbolic link attacks attacker should have at least a user level access to the system where attack would be performed. This is a file overwrite issue, attacker can create symbolic link to a file that is readable by attacker for e.g ln -s /etc/shadow /tmp/esrc or ln -s /etc/passwd /tmp/Mosaic.$PID. If Emacs session is ran by a normal user without any extra privileges , attacker would be stopped to create such links where a normal user don't have any permissions, if the Emacs is ran with root then the attacker would have more privileges.
The bug can be close because of https://bugzilla.redhat.com/show_bug.cgi?id=1095587 is already closed, right?
Or will there be a emacs updates for RHEL 5, 6 and 7?
Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.