CVE-2008-3076: OS Command Injection
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3076?
CVE-2008-3076 is classified as a medium severity vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2008-3076?
To fix CVE-2008-3076, update Vim to a version later than 7.2a.10 that includes patches for this vulnerability.
What software is affected by CVE-2008-3076?
CVE-2008-3076 specifically affects Vim version 7.2a.10.
What type of vulnerability is CVE-2008-3076?
CVE-2008-3076 is an arbitrary code execution vulnerability related to the Netrw plugin in Vim.
Can CVE-2008-3076 be exploited remotely?
CVE-2008-3076 requires user assistance for exploitation, as it involves malicious filenames.