From: Eli Zaretskii <eliz@gnu.org>
To: eggert@cs.ucla.edu
Cc: larsi@gnus.org, charles@aurox.ch, 28350@debbugs.gnu.org
Subject: bug#28350: enriched.el code execution
Date: Mon, 11 Sep 2017 17:22:48 +0300 [thread overview]
Message-ID: <83efrdtivb.fsf@gnu.org> (raw)
In-Reply-To: <83ingqt0v4.fsf@gnu.org> (message from Eli Zaretskii on Mon, 11 Sep 2017 05:39:27 +0300)
> Date: Mon, 11 Sep 2017 05:39:27 +0300
> From: Eli Zaretskii <eliz@gnu.org>
> Cc: larsi@gnus.org, charles@aurox.ch, 28350@debbugs.gnu.org
>
> > From: Paul Eggert <eggert@cs.ucla.edu>
> > Date: Sun, 10 Sep 2017 14:46:59 -0700
> > Cc: larsi@gnus.org, 28350@debbugs.gnu.org
> >
> > > (eval-after-load "enriched"
> > > '(defun enriched-decode-display-prop (start end &optional param)
> > > (list start end)))
> > >
> > > But it may not work in Emacs earlier than 23 (I can't test it).
> >
> > It should work, since eval-after-load predates Emacs 19.29. Though it assumes
> > that x-display is the only problem here.
>
> x-display _is_ the only problem, because only it allows arbitrary Lisp
> forms.
I eventually decided to provide a simpler patch, see below. The
original changes unnecessarily removed the capability to encode
display properties while saving Enriched Mode text, something that
doesn't have any security issues (because the vulnerability is on the
receiving end). I also prefer not to remove the offending code, but
instead to comment it out, as I believe this is more in the tradition
of Free Software to let people eyeball what we did. Finally, I
rewrote the NEWS entry to be more accurate wrt the actual change.
Nicolas is working on the release as we speak, so if someone has
suggestions, or objections, or something else important to say about
the patch, please speak up.
I'd like to take this opportunity to thank all those who worked and
continue working on fixing this vulnerability.
2017-09-11 Eli Zaretskii <eliz@gnu.org>
* etc/NEWS: Document the vulnerability and its resolution.
Include a workaround. Suggested by Charles A. Roelli
<charles@aurox.ch>.
* lisp/gnus/mm-view.el (mm-inline-text): Disable decoding of
"enriched" and "richtext" MIME objects. Suggested by Lars
Ingebrigtsen <larsi@gnus.org>.
* lisp/textmodes/enriched.el (enriched-decode-display-prop): Don't
produce 'display' properties. (Bug#28350)
--- lisp/textmodes/enriched.el~0 2017-02-03 12:25:44.000000000 +0200
+++ lisp/textmodes/enriched.el 2017-09-11 17:31:35.943569900 +0300
@@ -503,6 +503,9 @@
(error nil)))))
(unless prop
(message "Warning: invalid <x-display> parameter %s" param))
- (list start end 'display prop)))
+ ;; Disabled in Emacs 25.3 to avoid execution of arbitrary Lisp
+ ;; forms in display properties stored within enriched text.
+ ;; (list start end 'display prop)))
+ (list start end)))
;;; enriched.el ends here
--- lisp/gnus/mm-view.el~0 2017-02-03 12:25:44.000000000 +0200
+++ lisp/gnus/mm-view.el 2017-09-11 16:56:58.804519400 +0300
@@ -383,10 +383,12 @@
(goto-char (point-max))))
(save-restriction
(narrow-to-region b (point))
- (when (member type '("enriched" "richtext"))
- (set-text-properties (point-min) (point-max) nil)
- (ignore-errors
- (enriched-decode (point-min) (point-max))))
+ ;; Disabled in Emacs 25.3 to avoid execution of arbitrary Lisp
+ ;; forms in display properties supported by enriched.el.
+ ;; (when (member type '("enriched" "richtext"))
+ ;; (set-text-properties (point-min) (point-max) nil)
+ ;; (ignore-errors
+ ;; (enriched-decode (point-min) (point-max))))
(mm-handle-set-undisplayer
handle
`(lambda ()
--- etc/NEWS~0 2017-02-21 11:08:27.000000000 +0200
+++ etc/NEWS 2017-09-11 17:21:06.994252400 +0300
@@ -16,6 +16,32 @@
with a prefix argument or by typing C-u C-h C-n.
\f
+* Changes in Emacs 25.3
+
+This is an emergency release to fix a security vulnerability in Emacs.
+
+** Security vulnerability related to Enriched Text mode is removed.
+
+*** Enriched Text mode has its support for decoding 'x-display' disabled.
+This feature allows saving 'display' properties as part of text.
+Emacs 'display' properties support evaluation of arbitrary Lisp forms
+as part of instantiating the property, so decoding 'x-display' is
+vulnerable to executing arbitrary malicious Lisp code included in the
+text (e.g., sent as part of an email message).
+
+This vulnerability was introduced in Emacs 19.29. To work around that
+in Emacs versions before 25.3, append the following to your ~/.emacs
+init file:
+
+ (eval-after-load "enriched"
+ '(defun enriched-decode-display-prop (start end &optional param)
+ (list start end)))
+
+*** Gnus no longer supports "richtext" and "enriched" inline MIME objects.
+This support was disabled to avoid evaluation of arbitrary Lisp code
+contained in email messages and news articles.
+
+\f
* Changes in Emacs 25.2
This is mainly a bug-fix release, but there are some other changes.
next prev parent reply other threads:[~2017-09-11 14:22 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-04 19:24 bug#28350: enriched.el code execution Charles A. Roelli
2017-09-06 19:25 ` Charles A. Roelli
2017-09-07 2:34 ` Eli Zaretskii
2017-09-09 12:23 ` Charles A. Roelli
2017-09-09 13:45 ` Eli Zaretskii
2017-09-09 15:57 ` Charles A. Roelli
2017-09-09 16:55 ` Eli Zaretskii
2017-09-09 20:37 ` Charles A. Roelli
2017-09-10 17:01 ` Eli Zaretskii
2017-09-11 16:32 ` Glenn Morris
2017-09-11 17:01 ` Eli Zaretskii
2017-09-09 22:43 ` Paul Eggert
2017-09-10 18:54 ` Charles A. Roelli
2017-09-10 21:46 ` Paul Eggert
2017-09-11 2:39 ` Eli Zaretskii
2017-09-11 14:22 ` Eli Zaretskii [this message]
2017-09-11 15:18 ` Eli Zaretskii
2017-09-11 18:44 ` Charles A. Roelli
2017-09-11 19:07 ` Eli Zaretskii
2017-09-16 9:48 ` Eli Zaretskii
2017-09-11 15:33 ` Glenn Morris
2017-09-11 16:38 ` Paul Eggert
2017-09-11 21:16 ` Glenn Morris
2017-09-12 19:59 ` Paul Eggert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=83efrdtivb.fsf@gnu.org \
--to=eliz@gnu.org \
--cc=28350@debbugs.gnu.org \
--cc=charles@aurox.ch \
--cc=eggert@cs.ucla.edu \
--cc=larsi@gnus.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.