CVE-2008-2712: Input Validation
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2712 to the following vulnerability:
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (2) zipplugin, (3) xpm.vim, (4) gzipvim, and (5) netrw.
References: http://www.rdancer.org/vulnerablevim.html http://www.securityfocus.com/archive/1/archive/1/493352/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/493353/100/0/threaded http://marc.info/?l=bugtraq&m=121345541027231&w=4 http://www.openwall.com/lists/oss-security/2008/06/16/2 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=486502
Other sources
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzipvim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2008-2712?
CVE-2008-2712 is classified as a medium severity vulnerability due to its requirement for user assistance to exploit.
How do I fix CVE-2008-2712?
To fix CVE-2008-2712, update Vim to a version higher than 7.1.314 or apply patches provided by your operating system vendor.
What software is affected by CVE-2008-2712?
CVE-2008-2712 affects multiple versions of Vim, including 6.4, and up to 7.1.314.
What type of attacks can exploit CVE-2008-2712?
CVE-2008-2712 can be exploited by user-assisted remote attackers to execute arbitrary commands through Vim scripts.
Is CVE-2008-2712 still a concern today?
While CVE-2008-2712 was identified in 2008, it is crucial to ensure all systems are updated to mitigate any potential residual risks.