REDHAT-BUG-481565: Low severity suse vim vulnerability

Published Jan 26, 2009

Updated

Untrusted search path vulnerability in the of Vim allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.

References (test case, PoC): http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Proposed patch: The Debian patch for similar dia's Python related issue, available at:

http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=pythonpath.diff;att=1;bug=504251

should be sufficient to resolve this issue.

Affected Software

1 affected component

vim Vim

Event History

Jan 26, 2009

Data Sourced

via Red Hat·12:45 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-481565?

The severity of REDHAT-BUG-481565 is considered high due to the potential for local users to execute arbitrary code.

How do I fix REDHAT-BUG-481565?

To fix REDHAT-BUG-481565, update Vim to the latest patched version that addresses the untrusted search path vulnerability.

What systems are affected by REDHAT-BUG-481565?

The vulnerability REDHAT-BUG-481565 affects all versions of Vim that are configured to allow untrusted Python files.

What are the risks of not addressing REDHAT-BUG-481565?

Failing to address REDHAT-BUG-481565 could lead to the execution of malicious code by local users, compromising system integrity.

Is there a workaround for REDHAT-BUG-481565?

A temporary workaround for REDHAT-BUG-481565 includes avoiding the use of Vim in directories containing untrusted Python files.