CVE-2000-0269: Low severity gnu Emacs vulnerability
Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess, which allows local users to read or modify communications between Emacs and the subprocess.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
GNU Emacs 20from your environment.Uninstall GNU Emacs 20 until an official patch/fixed version is made available to avoid exposure from improper PTY slave permission handling.
- Configuration
Disable Emacs features that start subprocesses or allocate PTYs so Emacs does not create slave PTY devices with incorrect permissions.
GNU Emacs 20 start subprocesses (PTY allocation) = disabled - Compensating control
Prevent untrusted local users from accessing the affected host (restrict interactive logins and local accounts). The vulnerability allows local users to read or modify communications between Emacs and its subprocesses, so limit local access until a fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0269?
CVE-2000-0269 has a moderate severity rating due to the potential for local users to intercept communications.
How do I fix CVE-2000-0269?
To fix CVE-2000-0269, ensure that you upgrade to the latest patched version of GNU Emacs where the permissions for slave PTY devices are correctly set.
Which versions of Emacs are affected by CVE-2000-0269?
CVE-2000-0269 affects GNU Emacs versions 20.0 through 20.6.
What kind of attacks can exploit CVE-2000-0269?
CVE-2000-0269 can be exploited by local users to read or modify data exchanged between Emacs and subprocesses.
Is CVE-2000-0269 a remote or local vulnerability?
CVE-2000-0269 is a local vulnerability, requiring access to the affected system to exploit.