PT-2009-1201 · Vim · Vim

Published 2009-02-21 · Updated 2017-08-08 · CVE-2008-3076

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vim version 7.2a.10

Description The issue allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within certain commands. This is reportedly due to an incomplete fix for a previous issue.

Recommendations For Vim version 7.2a.10, consider avoiding the use of shell metacharacters in filenames when using the execute and system functions within the affected commands as a temporary workaround until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2008-3076

DSA-1733-1

Affected Products

Vim

References · 21

• 🔥 http://openwall.com/lists/oss-security/2008/07/07/4 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2008/07/07/1 · Exploit
• 🔥 http://securityfocus.com/bid/30115 · Exploit
• 🔥 https://exploit-db.com/exploits/32012 · Exploit
• 🔥 http://marc.info/?l=oss-security&m=122416184431388&w=2 · Exploit
• 🔥 http://rdancer.org/vulnerablevim-netrw.v2.html · Exploit
• 🔥 http://rdancer.org/vulnerablevim-netrw.html · Exploit
• http://redhat.com/support/errata/RHSA-2008-0580.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3076 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:236 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-3076 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-3076 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3076 · Security Note
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324 · Note