PT-2009-1709 · Vim+1 · Vim+1

Published 2008-11-25 · Updated 2017-09-29 · CVE-2008-6235

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Vim versions 7.0 through 7.1

Description: The issue allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the "D" (delete) command or b:netrw curdir variable. This has been demonstrated using test cases.

Recommendations: For versions 7.0 and 7.1, consider disabling the netrw.vim plugin until a patch is available. Restrict access to the b:netrw curdir variable and avoid using the "D" command with untrusted filenames to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2008-6235

RHSA-2008:0580

RHSA-2008_0580

Affected Products

Red Hat

Vim

References · 25

• 🔥 http://rdancer.org/vulnerablevim-netrw.v5.html · Exploit
• 🔥 http://rdancer.org/vulnerablevim-netrw.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2008/10/16/2 · Exploit
• http://rdancer.org/vulnerablevim-netrw.v2.html · Patch
• http://redhat.com/support/errata/RHSA-2008-0580.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-6235 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6235 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-6235 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-6235 · Vendor Advisory
• http://ftp.vim.org/pub/vim/patches/7.2/7.2.010 · Note
• http://rdancer.org/vulnerablevim.html · Note
• http://openwall.com/lists/oss-security/2008/07/07/4 · Note
• http://groups.google.com/group/vim_dev/browse_thread/thread/1434d0812b5c817e/6ad2d5b50a96668e · Note
• https://access.redhat.com/security/cve/CVE-2008-3074 · Note