PT-2008-5890 · Vim+1 · Vim+2

Jan Lieskovsky · Publicado 2008-10-22 · Atualizado 2017-08-08 · CVE-2008-4677

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions autoload/netrw.vim (aka the Netrw Plugin) versions prior to 133k for Vim 7.1 and 7.2

Description The issue allows remote FTP servers to obtain sensitive information by logging usernames and passwords when attempting to establish subsequent FTP sessions to servers on different hosts. This occurs because the software stores credentials for an FTP session and sends those credentials when attempting to establish subsequent FTP sessions.

Recommendations For versions prior to 133k, update to version 133k or later to resolve the issue. As a temporary workaround, consider restricting the use of the Netrw Plugin for FTP sessions to minimize the risk of exploitation. Avoid using the same username and password across different FTP servers until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2008-4677

ECHO-221D-CEF9-D3F8

Produtos afetados

Debian

Netrw Plugin

Vim

Referências · 22

• https://osv.dev/vulnerability/CVE-2008-4677 · Aviso do Fabricante
• http://rdancer.org/vulnerablevim-netrw-credentials-dis.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-4677 · Aviso do Fabricante
• http://secunia.com/advisories/31464 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4677 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4677 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2008/10/06/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4677 · Nota de Segurança
• http://openwall.com/lists/oss-security/2008/10/16/2 · Nota
• https://packages.debian.org/src:vim · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2008:236 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2379 · Nota
• http://securityfocus.com/archive/1/495436 · Nota
• http://secunia.com/advisories/34418 · Nota
• http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6 · Nota