Vulnerability Description
Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Vim | Vim | <= 6.4 |
| Canonical | Ubuntu Linux | 6.06 |
Related Weaknesses (CWE)
References
- http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlMailing ListThird Party Advisory
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.htmlThird Party Advisory
- http://marc.info/?l=bugtraq&m=121494431426308&w=2Mailing ListThird Party Advisory
- http://secunia.com/advisories/30731Third Party Advisory
- http://secunia.com/advisories/32222Third Party Advisory
- http://secunia.com/advisories/32858Third Party Advisory
- http://secunia.com/advisories/32864Third Party Advisory
- http://secunia.com/advisories/33410Third Party Advisory
- http://secunia.com/advisories/34418Third Party Advisory
- http://securityreason.com/securityalert/3951Third Party Advisory
- http://support.apple.com/kb/HT3216Third Party Advisory
- http://support.apple.com/kb/HT4077Third Party Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-457.htmThird Party Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2009-001.htmThird Party Advisory
FAQ
What is CVE-2008-2712?
CVE-2008-2712 is a vulnerability with a CVSS score of 9.3 (HIGH). Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system func...
How severe is CVE-2008-2712?
CVE-2008-2712 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-2712?
Check the references section above for vendor advisories and patch information. Affected products include: Vim Vim, Canonical Ubuntu Linux.