oss-security - vim/neovim: Arbitrary command execution (CVE-2016-1248)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20161122161915.wut6macbvu4ggdpn@freya.jamessan.com>
Date: Tue, 22 Nov 2016 11:19:15 -0500
From: James McCoy <jamessan@...ian.org>
To: oss-security@...ts.openwall.com
Subject: vim/neovim: Arbitrary command execution (CVE-2016-1248)

Hi all,

CVE-2016-1248 was assigned for a vulnerability in Vim which would allow
arbitrary shell commands to be run if a user opened a file with a
malicious modeline.  This is due to lack of validation of values for a
few options.  Those options' values are then used in Vim's scripts to
build a command string that's evaluated by :execute, which is what
allows the shell commands to be run.

This has been fixed in Vim by patch 8.0.0056[0], and new Windows builds
of Vim have been published with the fix, however the implications have
not yet been disclosed.

Since Neovim shares this code, it is also vulnerable.  It is fixed by
commit 4fad66f[1], but has not yet had a release.

This affects Vim at least as far back as 7.0.  I didn't check any older
versions.

This affects all released versions of Neovim.

Thanks to Florian Larysch for discovering this issue.

[0]: https://github.com/vim/vim/releases/tag/v8.0.0056
[1]: https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040

Cheers,
-- 
James
GPG Key: 4096R/91BF BF4D 6956 BD5D F7B7  2D23 DFE6 91AE 331B A3DB

View attachment "vim_CVE-2016-1248.patch" of type "text/x-diff" (3946 bytes)

View attachment "neovim_CVE-2016-1248.patch" of type "text/x-diff" (4088 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.