CVE-2008-6235: OS Command Injection
The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrwcurdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6235?
CVE-2008-6235 has a moderate severity rating as it allows user-assisted attackers to execute arbitrary commands.
How do I fix CVE-2008-6235?
To fix CVE-2008-6235, upgrade Vim to version 7.2 or later, which addresses this vulnerability.
What versions of Vim are affected by CVE-2008-6235?
Vim versions 7.0 and 7.1 are affected by CVE-2008-6235.
What capabilities does CVE-2008-6235 exploit?
CVE-2008-6235 exploits the processing of filenames in the Netrw plugin, allowing command execution via shell metacharacters.
Is user interaction required for CVE-2008-6235 to be exploited?
Yes, user interaction is required to exploit CVE-2008-6235 since it requires the attacker to present a specially crafted filename.