CVE-2008-3432: Buffer Overflow
Heap-based buffer overflow in the mchexpandwildcards function in osunix.c in Vim 6.2 and 6.3 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames, as demonstrated by the netrw.v3 test case.
Other sources
Jan Minar's test suite [1] for multiple vim vulnerabilities uncovered an old vim bug that could trigger a heap buffer overflow in mchexpandwildcards() in osunix.c when file or directory with specially crafted name is opened in vim.
[1] http://www.rdancer.org/vulnerablevim-netrw.tar.bz2
Issue is caused by incorrect computation of memory requirements for buffer to store external command executed by vim. File / directory name is escaped / quoted before being passed to an external command, however, possible quoting is not taken into account when allocating memory.
Issue was introduced in 6.2.429: http://vim.cvs.sourceforge.net/vim/vim/src/osunix.c?view=log#rev1.104 ftp://ftp.vim.org/pub/vim/patches/6.2.429
and fixed upstream in 6.3.059: http://vim.cvs.sourceforge.net/vim/vim/src/osunix.c?view=log#rev1.111 ftp://ftp.vim.org/pub/vim/patches/6.3/6.3.059
and later re-written for vim 7.0 to use backslash escaping instead of quoting: http://vim.cvs.sourceforge.net/vim/vim7/src/osunix.c?r1=1.49&r2=1.50
For further details, see: http://www.openwall.com/lists/oss-security/2008/07/15/4
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3432?
CVE-2008-3432 is classified as a high-severity vulnerability due to its ability to allow arbitrary code execution.
How do I fix CVE-2008-3432?
To fix CVE-2008-3432, upgrade Vim to version 6.4 or later where the vulnerability has been addressed.
What platforms are affected by CVE-2008-3432?
CVE-2008-3432 affects Vim versions 6.2 and 6.3 running on Unix-like operating systems.
Can CVE-2008-3432 be exploited remotely?
CVE-2008-3432 requires user assistance for exploitation, typically through crafted filenames.
What is the attack vector for CVE-2008-3432?
The attack vector for CVE-2008-3432 involves shell metacharacters in filenames leading to a heap-based buffer overflow.