Actu
Vigil@nce: Vim, command execution
August 2008 by Vigil@nce
SYNTHESIS
An attacker can take advantage of a lack of sanitization, to
execute commands on victim’s computer.
Gravity: 2/4
Consequences: privileged access/rights
Provenance: user account
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 25/08/2008
Identifier: VIGILANCE-VUL-8047
IMPACTED PRODUCTS
– Unix - plateform
DESCRIPTION
The Vim program is a text editor compatible with the standard vi.
It has a vulnerability related to a lack of command sanitization.
Vulnerabilities are in the "src/normal.c" file, in line 5519 and
5522. Indeed, several characters are not escaped when the K
command is used. It is therefore possible to execute application
from the Vim command line.
An attacker can therefore take advantages of this lack of
sanitisation to execute commands on victim’s computer.
CHARACTERISTICS
Identifiers: VIGILANCE-VUL-8047
