PT-2008-4157 · Vim+1 · Vim+1

Jan Minar · Published 2008-06-16 · Updated 2018-11-01 · CVE-2008-2712

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vim versions prior to 7.1.314

Description The issue allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions. This can be demonstrated using various scripts such as filetype.vim, xpm.vim, gzip vim, and netrw.

Recommendations For versions prior to 7.1.314, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of potentially vulnerable scripts until a patch is available. Avoid using the execute or system functions with unsanitized inputs in Vim scripts.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-2712

DSA-1733-1

DTSA-143-1

RHSA-2008:0580

RHSA-2008:0617

RHSA-2008:0618

RHSA-2008_0580

RHSA-2008_0617

Affected Products

Red Hat

Vim

References · 61

• 🔥 https://exploit-db.com/exploits/31911 · Exploit
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0580.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0617.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-2712 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0618.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2712 · Vendor Advisory
• http://ubuntu.com/usn/USN-712-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2712 · Security Note
• http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:236 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-2712 · Vendor Advisory
• http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm · Note
• http://secunia.com/advisories/32222 · Note