Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.900412
Category:General
Title:Vim Shell Command Injection Vulnerability (Linux)
Summary:This host is installed with Vim and is prone to Command Injection; Vulnerability.
Description:Summary:
This host is installed with Vim and is prone to Command Injection
Vulnerability.

Vulnerability Insight:
This error is due to the 'filetype.vim', 'tar.vim', 'zip.vim', 'xpm.vim',
'xpm2.vim', 'gzip.vim', and 'netrw.vim' scripts which are insufficiently filtering special characters.

Vulnerability Impact:
Successful exploitation will let the attacker execute arbitrary shell commands
to compromise the system.

Affected Software/OS:
Vim version prior to 7.2 on Linux.

Solution:
Upgrade to version 7.2 or later.

CVSS Score:
9.3

CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C

Cross-Ref: BugTraq ID: 32462
Common Vulnerability Exposure (CVE) ID: CVE-2008-2712
http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
BugTraq ID: 29715
http://www.securityfocus.com/bid/29715
BugTraq ID: 31681
http://www.securityfocus.com/bid/31681
Bugtraq: 20080613 Collection of Vulnerabilities in Fully Patched Vim 7.1 (Google Search)
http://www.securityfocus.com/archive/1/493352/100/0/threaded
Bugtraq: 20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1 (Google Search)
http://www.securityfocus.com/archive/1/493353/100/0/threaded
http://marc.info/?l=bugtraq&m=121494431426308&w=2
Bugtraq: 20080811 rPSA-2008-0247-1 gvim vim vim-minimal (Google Search)
http://www.securityfocus.com/archive/1/495319/100/0/threaded
Bugtraq: 20090401 VMSA-2009-0004 ESX Service Console updates for openssl, bind, and vim (Google Search)
http://www.securityfocus.com/archive/1/502322/100/0/threaded
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://www.rdancer.org/vulnerablevim.html
http://www.openwall.com/lists/oss-security/2008/06/16/2
http://www.openwall.com/lists/oss-security/2008/10/15/1
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11109
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6238
http://www.redhat.com/support/errata/RHSA-2008-0580.html
http://www.redhat.com/support/errata/RHSA-2008-0617.html
http://www.redhat.com/support/errata/RHSA-2008-0618.html
http://www.securitytracker.com/id?1020293
http://secunia.com/advisories/30731
http://secunia.com/advisories/32222
http://secunia.com/advisories/32858
http://secunia.com/advisories/32864
http://secunia.com/advisories/33410
http://secunia.com/advisories/34418
http://securityreason.com/securityalert/3951
SuSE Security Announcement: SUSE-SR:2009:007 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://www.ubuntu.com/usn/USN-712-1
http://www.vupen.com/english/advisories/2008/1851/references
http://www.vupen.com/english/advisories/2008/2780
http://www.vupen.com/english/advisories/2009/0033
http://www.vupen.com/english/advisories/2009/0904
XForce ISS Database: vim-scripts-command-execution(43083)
https://exchange.xforce.ibmcloud.com/vulnerabilities/43083
Common Vulnerability Exposure (CVE) ID: CVE-2008-3074
http://www.securityfocus.com/bid/32462
http://www.rdancer.org/vulnerablevim-shellescape.html
http://www.openwall.com/lists/oss-security/2008/07/07/1
http://www.openwall.com/lists/oss-security/2008/07/07/4
http://www.openwall.com/lists/oss-security/2008/07/08/12
http://www.openwall.com/lists/oss-security/2008/07/10/7
http://www.openwall.com/lists/oss-security/2008/07/13/1
http://www.openwall.com/lists/oss-security/2008/07/15/4
http://www.openwall.com/lists/oss-security/2008/08/01/1
http://www.openwall.com/lists/oss-security/2008/10/20/2
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10754
Common Vulnerability Exposure (CVE) ID: CVE-2008-3075
BugTraq ID: 32463
http://www.securityfocus.com/bid/32463
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10246
Common Vulnerability Exposure (CVE) ID: CVE-2008-3076
BugTraq ID: 30115
http://www.securityfocus.com/bid/30115
http://www.rdancer.org/vulnerablevim-netrw.html
http://www.rdancer.org/vulnerablevim-netrw.v2.html
http://marc.info/?l=oss-security&m=122416184431388&w=2
XForce ISS Database: netrw-multiple-code-execution(43624)
https://exchange.xforce.ibmcloud.com/vulnerabilities/43624
CopyrightCopyright (C) 2008 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.