Bug 65237 (CVE-2005-0100)

Hello Werner, 
we received this on through vendor-sec. (therefore not public) 
 
From: Martin Schulze <joey@infodrom.org> 
To: Free Software Distribution Vendors <vendor-sec@lst.de> 
User-Agent: Mutt/1.5.6+20040907i 
Subject: [vendor-sec] CAN-2005-0100: Arbitrary code execution in *emacs* 
Errors-To: vendor-sec-admin@lst.de 
Date: Thu, 27 Jan 2005 10:09:03 +0100 
 
Max Vozeler discovered several format string vulnerabilities in the 
movemail utility of Emacs, the well-known editor.  Via connecting to a 
malicious POP server an attacker can execute arbitrary code under the 
privileges of group mail (or worse, depending on the permissions of 
the movemail binary). 
 
I propose to disclose this on February 10th as well. 
 
I'm attaching the patches for emacs21 and xemacs21 by Max. 
 
Upstream is informed as well. 
 
Regards, 
 
        Joey 
 
-- 
 
--- emacs21-21.3+1/lib-src/movemail.c.orig      2005-01-16 09:08:52.000000000 
+0100 
+++ emacs21-21.3+1/lib-src/movemail.c   2005-01-16 09:11:40.000000000 +0100 
@@ -787,7 +787,7 @@ 
       mbx_delimit_begin (mbf); 
       if (pop_retr (server, i, mbf) != OK) 
        { 
-         error (Errmsg, 0, 0); 
+         error ("%s", Errmsg, 0); 
          close (mbfi); 
          return (1); 
        } 
 
--- xemacs21-21.4.16/lib-src/movemail.c.orig    2005-01-16 09:05:05.000000000 
+0100 
+++ xemacs21-21.4.16/lib-src/movemail.c 2005-01-16 09:07:04.000000000 +0100 
@@ -741,14 +741,14 @@ 
   server = pop_open (0, user, password, POP_NO_GETPASS); 
   if (! server) 
     { 
-      error (pop_error, NULL, NULL); 
+      error ("%s", pop_error, NULL); 
       return (1); 
     } 
 
   VERBOSE(("stat'ing messages\n")); 
   if (pop_stat (server, &nmsgs, &nbytes)) 
     { 
-      error (pop_error, NULL, NULL); 
+      error ("%s", pop_error, NULL); 
       return (1); 
     } 
 
@@ -796,7 +796,7 @@ 
           mbx_delimit_begin (mbf); 
          if (pop_retr (server, i, mbx_write, mbf) != POP_RETRIEVED) 
            { 
-             error (Errmsg, NULL, NULL); 
+             error ("%s", Errmsg, NULL); 
              close (mbfi); 
              return (1); 
            } 
@@ -844,7 +844,7 @@ 
              VERBOSE(("deleting message %d     \n", i)); 
              if (pop_delete (server, i)) 
                { 
-                 error (pop_error, NULL, NULL); 
+                 error ("%s", pop_error, NULL); 
                  pop_close (server); 
                  return (1); 
                } 
@@ -855,7 +855,7 @@ 
   VERBOSE(("closing server             \n")); 
   if (pop_quit (server)) 
     { 
-      error (pop_error, NULL, NULL); 
+      error ("%s", pop_error, NULL); 
       return (1); 
     }