PT-2009-1201 · Vim · Vim

Publicado 2009-02-21 · Atualizado 2017-08-08 · CVE-2008-3076

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vim version 7.2a.10

Description The issue allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within certain commands. This is reportedly due to an incomplete fix for a previous issue.

Recommendations For Vim version 7.2a.10, consider avoiding the use of shell metacharacters in filenames when using the execute and system functions within the affected commands as a temporary workaround until a patch is available.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2008-3076

DSA-1733-1

Produtos afetados

Vim

Referências · 21

• 🔥 http://openwall.com/lists/oss-security/2008/07/07/4 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2008/07/07/1 · Exploit
• 🔥 http://securityfocus.com/bid/30115 · Exploit
• 🔥 https://exploit-db.com/exploits/32012 · Exploit
• 🔥 http://marc.info/?l=oss-security&m=122416184431388&w=2 · Exploit
• 🔥 http://rdancer.org/vulnerablevim-netrw.v2.html · Exploit
• 🔥 http://rdancer.org/vulnerablevim-netrw.html · Exploit
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43624 · Nota
• http://redhat.com/support/errata/RHSA-2008-0580.html · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=121494431426308&w=2 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3076 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2008:236 · Aviso do Fabricante
• http://secunia.com/advisories/34418 · Nota
• https://security-tracker.debian.org/tracker/CVE-2008-3076 · Aviso do Fabricante