Actu
Vigil@nce: Vim, code execution via filetype.vim
July 2008 by Vigil@nce
An attacker can create a malicious file leading to code execution
when it is opened by Vim.
– Gravity: 1/4
– Consequences: user access/rights
– Provenance: document
– Means of attack: 1 attack
– Ability of attacker: technician (2/4)
– Confidence: unique source (2/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 24/07/2008
– Identifier: VIGILANCE-VUL-7968
IMPACTED PRODUCTS
Unix - plateform
DESCRIPTION
The Vim editor parses the first lines of files in order to find
instructions, such as the size of tabulations.
The asmsyntax instruction indicates the name of the program to use
to format assembler files. For example:
:asmsyntax=nasm
An attacker can specify an arbitrary name for the program in order
to execute it when the file is opened.
An attacker can therefore create a malicious file leading to code
execution when it is opened by Vim.
CHARACTERISTICS
– Identifiers: VIGILANCE-VUL-7968
– Url:https://vigilance.aql.fr/tree/1/7968
