PT-2008-5890 · Vim+1 · Vim+2

Jan Lieskovsky · Published 2008-10-22 · Updated 2017-08-08 · CVE-2008-4677

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions autoload/netrw.vim (aka the Netrw Plugin) versions prior to 133k for Vim 7.1 and 7.2

Description The issue allows remote FTP servers to obtain sensitive information by logging usernames and passwords when attempting to establish subsequent FTP sessions to servers on different hosts. This occurs because the software stores credentials for an FTP session and sends those credentials when attempting to establish subsequent FTP sessions.

Recommendations For versions prior to 133k, update to version 133k or later to resolve the issue. As a temporary workaround, consider restricting the use of the Netrw Plugin for FTP sessions to minimize the risk of exploitation. Avoid using the same username and password across different FTP servers until the issue is resolved.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-4677

ECHO-221D-CEF9-D3F8

Affected Products

Debian

Netrw Plugin

Vim

References · 22

• https://osv.dev/vulnerability/CVE-2008-4677 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-4677 · Vendor Advisory
• http://secunia.com/advisories/31464 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4677 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-4677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-4677 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2008:236 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/vim · Vendor Advisory
• http://rdancer.org/vulnerablevim-netrw-credentials-dis.html · Note
• http://openwall.com/lists/oss-security/2008/10/06/4 · Note
• http://openwall.com/lists/oss-security/2008/10/16/2 · Note
• https://packages.debian.org/src:vim · Note
• http://vupen.com/english/advisories/2008/2379 · Note
• http://securityfocus.com/archive/1/495436 · Note