exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 6 of 6 RSS Feed

CVE-2008-2712

Status Candidate

Overview

Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.

Related Files

VMware Security Advisory 2009-0004
Posted Apr 1, 2009
Authored by VMware | Site vmware.com

VMware Security Advisory - ESX patches for OpenSSL, vim and bind resolve several security issues. OpenSSL 0.9.7a-33.24 and earlier does not properly check the return value from the EVP_VerifyFinal function, which could allow a remote attacker to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. A flaw was discovered in the way Berkeley Internet Name Domain (BIND) checked the return value of the OpenSSL DSA_do_verify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. Various vulnerabilities were discovered in vim such as format string issues and input validation problems.

tags | advisory, remote, spoof, vulnerability
advisories | CVE-2008-5077, CVE-2009-0025, CVE-2008-4101, CVE-2008-3432, CVE-2008-2712, CVE-2007-2953
SHA-256 | 6cb3c24c65b6ce75a60be81d773ffe92365d8866329c83302255f5fa55cec7f1
Debian Security Advisory 1733
Posted Mar 3, 2009
Site debian.org

Debian Security Advisory 1733 - Several vulnerabilities have been found in vim, an enhanced vi editor.

tags | advisory, vulnerability
systems | linux, debian
advisories | CVE-2008-2712, CVE-2008-3074, CVE-2008-3075, CVE-2008-3076, CVE-2008-4104
SHA-256 | ac7379d457a6d77bac691d4b0a79c31d70bae3178e666cf6edf19545fa85f02f
Ubuntu Security Notice 712-1
Posted Jan 27, 2009
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice USN-712-1 - Jan Minar discovered that Vim did not properly sanitize inputs before invoking the execute or system functions inside Vim scripts. If a user were tricked into running Vim scripts with a specially crafted input, an attacker could execute arbitrary code with the privileges of the user invoking the program. Ben Schmidt discovered that Vim did not properly escape characters when performing keyword or tag lookups. If a user were tricked into running specially crafted commands, an attacker could execute arbitrary code with the privileges of the user invoking the program.

tags | advisory, arbitrary
systems | linux, ubuntu
advisories | CVE-2008-2712, CVE-2008-4101
SHA-256 | 77e456932ebdd05bc73a584e56d2845a523908dcbc0f87dc7d0ba23a4e7ed27b
Mandriva Linux Security Advisory 2008-236
Posted Dec 9, 2008
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2008-236-1 - A number of input sanitization flaws were found in various vim system functions. These issues have been corrected with these updated packages.

tags | advisory
systems | linux, mandriva
advisories | CVE-2008-2712, CVE-2008-2953, CVE-2008-3074, CVE-2008-3075, CVE-2008-3076, CVE-2008-4101, CVE-2008-4677
SHA-256 | 2c1199851c002a7cd04b032aaaf3dd54259a8d7854bc08944eec2cc34af18b5f
Mandriva Linux Security Advisory 2008-236
Posted Dec 4, 2008
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2008-236 - vim suffers from input sanitization, format string, and arbitrary code execution vulnerabilities.

tags | advisory, arbitrary, vulnerability, code execution
systems | linux, mandriva
advisories | CVE-2008-2712, CVE-2008-2953, CVE-2008-3074, CVE-2008-3075, CVE-2008-3076, CVE-2008-4101, CVE-2008-4677
SHA-256 | 165be09831b0a0e46b603c97fb0f80a49e7ef578c6376bb2360d775b3340c334
vim-tarplugin.txt
Posted Aug 8, 2008
Authored by Jan Minar

Vim versions 7.0 through 7.2c.002 suffer from unfixed vulnerabilities in Tar plugin version 20.

tags | advisory, vulnerability
advisories | CVE-2008-2712
SHA-256 | 8d2656b1d8ef0e29912ed8a10e520a3493d5bf180a29d0ed2cf3d359eed82a0c
Page 1 of 1
Back1Next

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close