Description of problem:

Jan Minar has reported the following problem present in Vim shellescape() function implementation and demonstrated by testcases in zip.vim plugin:

The implementation of the shellescape() function does not properly escape all special items, in particular the '!' character). This can result in untrusted data being insufficiently sanitized and possibly lead to arbitrary code execution.

To show this vulnerability can be exploited, the tar.vim plugin test cases has been updated (zipplugin and zipplugin.v2 test cases).

CVE-2008-3075 as been pre-assigned and used in rPath advisory:

http://www.openwall.com/lists/oss-security/2008/07/10/7 (ZIP-2)

References:

http://www.rdancer.org/vulnerablevim-shellescape.html http://www.rdancer.org/vulnerablevim.html (ZIP-1) http://www.openwall.com/lists/oss-security/2008/07/15/2 http://www.openwall.com/lists/oss-security/2008/07/13/1 (ZIP-4) http://www.openwall.com/lists/oss-security/2008/08/01/1

CVE-2008-2712 bullet (2)

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2712

mentions zipplugin based on same advisory as ZIP-1. According to ZIP-2 and ZIP-4 the zip.vim / zipplugin.vim has not been fixed as of Vim 7.2a.19/zip.vim v19, so the bullet (2) -- mention about zipplugin should be removed from CVE-2008-2712.

The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.