Description of problem:

Jan Minar has reported the following problem present in Vim shellescape() function implementation and demonstrated by testcases in tar.vim plugin:

The implementation of the shellescape() function does not properly escape all special items, in particular the '!' character). This can result in untrusted data being insufficiently sanitized and possibly lead to arbitrary code execution.

To show this vulnerability can be exploited, the tar.vim plugin test cases has been updated (tarplugin, tarplugin.v2 and tarplugin.updated test cases).

CVE-2008-3074 has been pre-assigned and used in rPath advisory:

http://www.openwall.com/lists/oss-security/2008/07/10/7

References:

http://www.rdancer.org/vulnerablevim-shellescape.html http://www.openwall.com/lists/oss-security/2008/07/15/2 http://www.openwall.com/lists/oss-security/2008/07/10/7 http://www.rdancer.org/vulnerablevim.html http://www.openwall.com/lists/oss-security/2008/07/13/1 http://www.openwall.com/lists/oss-security/2008/08/01/1