Vim Sandbox Functions Let Remote Users Execute Arbitrary Commands
|
|
SecurityTracker Alert ID: 1018035 |
|
SecurityTracker URL: http://securitytracker.com/id/1018035
|
|
CVE Reference:
CVE-2007-2438
(Links to External Site)
|
Date: May 10 2007
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 7.0
|
Description:
A vulnerability was reported in vim. A remote user can cause arbitrary commands to be executed on the target user's system.
A remote user can create a text file containing a specially crafted modeline that, when loaded by the target user, will execute arbitrary commands on the target system. The commands will run with the privileges of the target user.
The writefile, feedkeys, and system functions within the sandbox can be exploited.
Tomas Golembiovsky reported this vulnerability.
|
Impact:
A remote user can create a file that, when loaded by the target user, will execute arbitrary commands on the target user's system.
|
Solution:
The vendor has issued a source code fix ('src/eval.c').
|
Vendor URL: vim.org/ (Links to External Site)
|
Cause:
Access control error, Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 2007-04-26 21:35:07
Subject: feedkeys() allowed in sandbox
|
Greetings mortals,
today somebody came to #vim, and pasted some modeline (containig joke or
such). He muttered something about not knowing what that means and left
before long. But (!) what I noticed is that feedkeys() was used as part of
foldexpression and it turned out that feedkeys() is allowed in sandbox,
which means malicious file can run arbitrary command via modeline like
this:
vim: fdm=expr fde=feedkeys("\\:!touch\ phantom_was_here\\<cr>")
I guess you can see the consequences. Is this known/intentional?
--
Best regards,
Tomas Golembiovsky
--
|========================|----- - -
|
| Alan's Law of Research
|
| The theory is supported as long as the funds are.
|
|----- - -
|
|
