Description of problem:
Jan Minar has reported the following problem present in Vim shellescape() function implementation and demonstrated by testcases in tar.vim plugin:
The implementation of the shellescape() function does not properly escape all special items, in particular the '!' character). This can result in untrusted data being insufficiently sanitized and possibly lead to arbitrary code execution.
To show this vulnerability can be exploited, the tar.vim plugin test cases has been updated (tarplugin, tarplugin.v2 and tarplugin.updated test cases).
CVE-2008-3074 has been pre-assigned and used in rPath advisory:
http://www.openwall.com/lists/oss-security/2008/07/10/7
References:
http://www.rdancer.org/vulnerablevim-shellescape.html http://www.openwall.com/lists/oss-security/2008/07/15/2 http://www.openwall.com/lists/oss-security/2008/07/10/7 http://www.rdancer.org/vulnerablevim.html http://www.openwall.com/lists/oss-security/2008/07/13/1 http://www.openwall.com/lists/oss-security/2008/08/01/1
Description of problem:
Jan Minar has reported the following problem present in Vim shellescape() function implementation and demonstrated by testcases in zip.vim plugin:
The implementation of the shellescape() function does not properly escape all special items, in particular the '!' character). This can result in untrusted data being insufficiently sanitized and possibly lead to arbitrary code execution.
To show this vulnerability can be exploited, the tar.vim plugin test cases has been updated (zipplugin and zipplugin.v2 test cases).
CVE-2008-3075 as been pre-assigned and used in rPath advisory:
http://www.openwall.com/lists/oss-security/2008/07/10/7 (ZIP-2)
References:
http://www.rdancer.org/vulnerablevim-shellescape.html http://www.rdancer.org/vulnerablevim.html (ZIP-1) http://www.openwall.com/lists/oss-security/2008/07/15/2 http://www.openwall.com/lists/oss-security/2008/07/13/1 (ZIP-4) http://www.openwall.com/lists/oss-security/2008/08/01/1
CVE-2008-2712 bullet (2)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2712
mentions zipplugin based on same advisory as ZIP-1. According to ZIP-2 and ZIP-4 the zip.vim / zipplugin.vim has not been fixed as of Vim 7.2a.19/zip.vim v19, so the bullet (2) -- mention about zipplugin should be removed from CVE-2008-2712.
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-2712 to the following vulnerability:
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (2) zipplugin, (3) xpm.vim, (4) gzipvim, and (5) netrw.
References: http://www.rdancer.org/vulnerablevim.html http://www.securityfocus.com/archive/1/archive/1/493352/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/493353/100/0/threaded http://marc.info/?l=bugtraq&m=121345541027231&w=4 http://www.openwall.com/lists/oss-security/2008/06/16/2 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=486502