Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.

Max Vozeler discovered a format string vulnerability in the 'movemail' utility of Emacs. By sending specially crafted packets, a malicious POP3 server could cause a buffer overflow, which could have been exploited to execute arbitrary code with the privileges of the user and the 'mail' group (since 'movemail' is installed as 'setgid mail').

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs. They can be exploited when connecting to a malicious POP server and can allow an attacker can execute arbitrary code under the privileges of the user running Emacs.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:133 advisory.

    XEmacs is a powerful, customizable, self-documenting, modeless text editor.

    Max Vozeler discovered several format string vulnerabilities in the     movemail utility of XEmacs.  If a user connects to a malicious POP server,     an attacker can execute arbitrary code as the user running xemacs.  The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0100 to this issue.

    Users of XEmacs are advised to upgrade to these updated packages, which     contain backported patches to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:110 advisory.

    Emacs is a powerful, customizable, self-documenting, modeless text editor.

    Max Vozeler discovered several format string vulnerabilities in the     movemail utility of Emacs.  If a user connects to a malicious POP server,     an attacker can execute arbitrary code as the user running emacs.  The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0100 to this issue.

    Users of Emacs are advised to upgrade to these updated packages, which     contain backported patches to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs, the well-known editor. Via connecting to a malicious POP server an attacker can execute arbitrary code under the privileges of group mail.

Max Vozeler discovered several format string vulnerabilities in the movemail utility in Emacs. If a user connects to a malicious POP server, an attacker can execute arbitrary code as the user running emacs.

The updated packages have been patched to correct the problem.

The remote host is affected by the vulnerability described in GLSA-200502-20 (Emacs, XEmacs: Format string vulnerabilities in movemail)

    Max Vozeler discovered that the movemail utility contains several     format string errors.
  Impact :

    An attacker could set up a malicious POP server and entice a user to     connect to it using movemail, resulting in the execution of arbitrary     code with the rights of the victim user.
  Workaround :

    There is no known workaround at this time.

Updated XEmacs packages that fix a string format issue are now available.

XEmacs is a powerful, customizable, self-documenting, modeless text editor.

Max Vozeler discovered several format string vulnerabilities in the movemail utility of XEmacs. If a user connects to a malicious POP server, an attacker can execute arbitrary code as the user running xemacs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0100 to this issue.

Users of XEmacs are advised to upgrade to these updated packages, which contain backported patches to correct this issue.

Updated Emacs packages that fix a string format issue are now available.

Emacs is a powerful, customizable, self-documenting, modeless text editor.

Max Vozeler discovered several format string vulnerabilities in the movemail utility of Emacs. If a user connects to a malicious POP server, an attacker can execute arbitrary code as the user running emacs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0100 to this issue.

Users of Emacs are advised to upgrade to these updated packages, which contain backported patches to correct this issue.

ID	Name	Product	Family	Severity
20698	Ubuntu 4.10 : emacs21 vulnerability (USN-76-1)	Nessus	Ubuntu Local Security Checks	high
18910	FreeBSD : emacs -- movemail format string vulnerability (3e3c860d-7dae-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	high
17190	RHEL 4 : xemacs (RHSA-2005:133)	Nessus	Red Hat Local Security Checks	critical
17189	RHEL 4 : emacs (RHSA-2005:110)	Nessus	Red Hat Local Security Checks	critical
17130	Debian DSA-685-1 : emacs21 - format string	Nessus	Debian Local Security Checks	high
16473	Mandrake Linux Security Advisory : emacs (MDKSA-2005:038)	Nessus	Mandriva Local Security Checks	high
16471	GLSA-200502-20 : Emacs, XEmacs: Format string vulnerabilities in movemail	Nessus	Gentoo Local Security Checks	high
16369	RHEL 2.1 / 3 : xemacs (RHSA-2005:134)	Nessus	Red Hat Local Security Checks	high
16368	RHEL 2.1 / 3 : emacs (RHSA-2005:112)	Nessus	Red Hat Local Security Checks	high
16345	Debian DSA-671-1 : xemacs21 - format string	Nessus	Debian Local Security Checks	high
16344	Debian DSA-670-1 : emacs20 - format string	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2005-0100

critical

Tenable Plugins

high

high

critical

critical

high

high

high

high

high

high

high