[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0902211644420.16146@faron.mitre.org>
Date: Sat, 21 Feb 2009 16:48:04 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org, Jan Minář <rdancer@...ncer.org>
Subject: Re: Vim CVE issues cleanup (plugins tar.vim, zip.vim)
- CVE-2008-3074 and CVE-2008-3075
OK all, I'm finally imlementing some of the nasty, nasty cleanup of the
Vim issues. I am treating Jan Lieskovsky's analysis as the most
authoritative, so I am hopefully following his recommendations.
This first email shows how CVE-2008-3074, CVE-2008-3075, and CVE-2008-3076
have been written up. Jan, given how messy the whole thing is, I decided
that it was OK to keep CVE-2008-3074 and CVE-2008-3075 as separate, even
though they would have been merged if we had perfect, stable information
when this whole thing started.
- Steve
======================================================
Name: CVE-2008-3074
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3074
Reference: BUGTRAQ:20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1
Reference: URL:http://marc.info/?l=bugtraq&m=121494431426308&w=2
Reference: MLIST:[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/07/1
Reference: MLIST:[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/07/4
Reference: MLIST:[oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/08/12
Reference: MLIST:[oss-security] 20080710 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/10/7
Reference: MLIST:[oss-security] 20080713 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/13/1
Reference: MLIST:[oss-security] 20080715 Re: Re: More arbitrary code executions in Netrw
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/15/4
Reference: MLIST:[oss-security] 20080731 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/08/01/1
Reference: MLIST:[oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/15/1
Reference: MLIST:[oss-security] 20081020 CVE request (vim)
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/20/2
Reference: MISC:http://www.rdancer.org/vulnerablevim.html
Reference: MISC:http://www.rdancer.org/vulnerablevim-shellescape.html
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10,
allows user-assisted attackers to execute arbitrary code via the "!"
(exclamation point) shell metacharacter in (1) the filename of a tar
archive and possibly (2) the filename of the first file in a tar
archive, which is not properly handled by the VIM TAR plugin (tar.vim)
v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2,
tarplugin, and tarplugin.updated test cases. NOTE: this issue
reportedly exists because of an incomplete fix for CVE-2008-2712.
NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due
to the complexity of the associated disclosures and the incomplete
information related to them, there may be inaccuracies in this CVE
description and in external mappings to this identifier.
======================================================
Name: CVE-2008-3075
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3075
Reference: BUGTRAQ:20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1
Reference: URL:http://marc.info/?l=bugtraq&m=121494431426308&w=2
Reference: MLIST:[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/07/1
Reference: MLIST:[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/07/4
Reference: MLIST:[oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/08/12
Reference: MLIST:[oss-security] 20080710 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/10/7
Reference: MLIST:[oss-security] 20080713 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/13/1
Reference: MLIST:[oss-security] 20080715 Re: Re: More arbitrary code executions in Netrw
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/15/4
Reference: MLIST:[oss-security] 20080731 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/08/01/1
Reference: MLIST:[oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/15/1
Reference: MLIST:[oss-security] 20081020 CVE request (vim)
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/20/2
Reference: MISC:http://www.rdancer.org/vulnerablevim.html
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10,
allows user-assisted attackers to execute arbitrary code via the "!"
(exclamation point) shell metacharacter in (1) the filename of a ZIP
archive and possibly (2) the filename of the first file in a ZIP
archive, which is not properly handled by zip.vim in the VIM ZIP
plugin (zipPlugin.vim) v.11 through v.21, as demonstrated by the
zipplugin and zipplugin.v2 test cases. NOTE: this issue reportedly
exists because of an incomplete fix for CVE-2008-2712. NOTE: this
issue has the same root cause as CVE-2008-3074. NOTE: due to the
complexity of the associated disclosures and the incomplete
information related to them, there may be inaccuracies in this CVE
description and in external mappings to this identifier.
======================================================
Name: CVE-2008-3076
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3076
Reference: BUGTRAQ:20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1
Reference: URL:http://marc.info/?l=bugtraq&m=121494431426308&w=2
Reference: MLIST:[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/07/1
Reference: MLIST:[oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/07/4
Reference: MLIST:[oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/08/12
Reference: MLIST:[oss-security] 20081016 CVE request - Vim netrw.plugin
Reference: URL:http://marc.info/?l=oss-security&m=122416184431388&w=2
Reference: MLIST:[oss-security] 20081020 CVE request (vim)
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/20/2
Reference: MISC:http://www.rdancer.org/vulnerablevim-netrw.html
Reference: MISC:http://www.rdancer.org/vulnerablevim-netrw.v2.html
Reference: BID:30115
Reference: URL:http://www.securityfocus.com/bid/30115
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted
attackers to execute arbitrary code via shell metacharacters in
filenames used by the execute and system functions within the (1) mz
and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test
cases. NOTE: this issue reportedly exists because of an incomplete
fix for CVE-2008-2712.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
