Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution

[Nico Golde <oss-security+ml () ngolde de>]

Hi Robert,
* Robert Buchholz <rbu () gentoo org> [2008-05-14 02:50]:
> On Monday, 12. May 2008, Nico Golde wrote:
> > * Robert Buchholz <rbu () gentoo org> [2008-05-12 19:05]:
> > > On Monday, 12. May 2008, Nico Golde wrote:
[...] 
> > > > The same applies to emacs22.
> > >
> > > Our emacs maintainer said version 22 would warn you that lisp code
> > > from the file would be executed. Could you confirm otherwise?
> >
> > At least not with the emacs22 installation I tried this with (22.2).
> > As this is a rather old version, this may depend on the
> > version used?
>
> The 22.2 is only a few weeks old, is it not?

Ups sorry, my bad.

> Anyway, Ulrich Mueller (who is in CC) clarified the behaviour, I quote:
>
> > the issue may still occur in Emacs 22, if both of the following
> > conditions are fulfilled:
> > - the user sets fast-lock-mode as support mode for font-lock (which is
> >   not the default),
> > - the user explicitely loads fast-lock, ignoring the warning ("Package
> >   fast-lock is obsolete").
>
> I could not reproduce the issue in Emacs 22.2 with only the changed 
> configuration either, but maybe I just used Emacs the wrong way.

As I am a vim user I might have done something wrong too, 
not sure. What I did after installing emacs:
cat >> ~/.emacs << EOF
(global-font-lock-mode t)
(seq font-lock-support-mode 'fast-lock-mode)
EOF

cat >> foobar.c << EOF
/* no comment */
EOF

cat >> foobar.c.flc << EOF
" foobar "
EOF

starting emacs22, open foobar.c => no warning.

Could someone on the list who is an emacs user try this as 
well?

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: _bin
Description: