CVE-2008-3294: Code Injection

Published Jul 24, 2008

Updated

src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it ahead of time with permissions that prevent its modification by configure.

Affected Software

16 affected components

vim Vim=5.7

vim Vim=6.4

vim Vim=6.3

vim Vim=5.4

vim Vim=7.1

vim Vim=7.0

vim Vim=5.2

vim Vim=5.3

vim Vim=5.5

vim Vim=6.2

vim Vim=5.8

vim Vim=6.0

vim Vim=5.6

vim Vim=6.1

vim Vim=5.1

vim Vim=5.0

Event History

Jul 24, 2008

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3294?

CVE-2008-3294 is categorized as a medium severity vulnerability due to its potential to allow local users to execute arbitrary code.

How do I fix CVE-2008-3294?

To fix CVE-2008-3294, ensure that you upgrade to a version of Vim later than 7.1 where the Makefile-conf permissions and ownership issues have been resolved.

What software versions are affected by CVE-2008-3294?

CVE-2008-3294 affects Vim versions 5.0 through 7.1, particularly those with Python support enabled.

What kind of attack is possible with CVE-2008-3294?

With CVE-2008-3294, a local user can exploit the vulnerability by modifying the Makefile-conf temporary file to execute arbitrary code.

Is CVE-2008-3294 a remote or local vulnerability?

CVE-2008-3294 is a local vulnerability, meaning it can only be exploited by users with local access to the affected system.