Vulnerabilities > CVE-2008-2712 - Improper Input Validation vulnerability in VIM

CVSS 9.3 - CRITICAL

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

vim

canonical

CWE-20

critical

nessus

exploit available

NVD

Published: 2008-06-16

Updated: 2018-11-01

Summary

Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properly sanitize inputs before invoking the execute or system functions, as demonstrated using (1) filetype.vim, (3) xpm.vim, (4) gzip_vim, and (5) netrw. NOTE: the originally reported version was 7.1.314, but the researcher actually found this set of issues in 7.1.298. NOTE: the zipplugin issue (originally vector 2 in this identifier) has been subsumed by CVE-2008-3075.

Vulnerable Configurations

Part	Description	Count
Application	Vim VIM VIM 5.6 VIM VIM 6.1 VIM VIM 6.3 VIM VIM 6.4 VIM VIM 7.0 VIM VIM 7.0.001 VIM VIM 7.0.002 VIM VIM 7.0.003 VIM VIM 7.0.004 VIM VIM 7.0.005 VIM VIM 7.0.006 VIM VIM 7.0.007 VIM VIM 7.0.008 VIM VIM 7.0.009 VIM VIM 7.0.010 VIM VIM 7.0.011 VIM VIM 7.0.012 VIM VIM 7.0.013 VIM VIM 7.0.014 VIM VIM 7.0.015 VIM VIM 7.0.016 VIM VIM 7.0.017 VIM VIM 7.0.018 VIM VIM 7.0.019 VIM VIM 7.0.020 VIM VIM 7.0.021 VIM VIM 7.0.022 VIM VIM 7.0.023 VIM VIM 7.0.024 VIM VIM 7.0.025 VIM VIM 7.0.026 VIM VIM 7.0.027 VIM VIM 7.0.028 VIM VIM 7.0.029 VIM VIM 7.0.030 VIM VIM 7.0.031 VIM VIM 7.0.032 VIM VIM 7.0.033 VIM VIM 7.0.034 VIM VIM 7.0.035 VIM VIM 7.0.036 VIM VIM 7.0.037 VIM VIM 7.0.038 VIM VIM 7.0.039 VIM VIM 7.0.040 VIM VIM 7.0.041 VIM VIM 7.0.042 VIM VIM 7.0.043 VIM VIM 7.0.044 VIM VIM 7.0.045 VIM VIM 7.0.046 VIM VIM 7.0.047 VIM VIM 7.0.048 VIM VIM 7.0.049 VIM VIM 7.0.050 VIM VIM 7.0.051 VIM VIM 7.0.052 VIM VIM 7.0.053 VIM VIM 7.0.054 VIM VIM 7.0.055 VIM VIM 7.0.056 VIM VIM 7.0.057 VIM VIM 7.0.058 VIM VIM 7.0.059 VIM VIM 7.0.060 VIM VIM 7.0.061 VIM VIM 7.0.062 VIM VIM 7.0.063 VIM VIM 7.0.064 VIM VIM 7.0.065 VIM VIM 7.0.066 VIM VIM 7.0.067 VIM VIM 7.0.068 VIM VIM 7.0.069 VIM VIM 7.0.070 VIM VIM 7.0.071 VIM VIM 7.0.072 VIM VIM 7.0.073 VIM VIM 7.0.074 VIM VIM 7.0.075 VIM VIM 7.0.076 VIM VIM 7.0.077 VIM VIM 7.0.078 VIM VIM 7.0.079 VIM VIM 7.0.080 VIM VIM 7.0.081 VIM VIM 7.0.082 VIM VIM 7.0.083 VIM VIM 7.0.084 VIM VIM 7.0.085 VIM VIM 7.0.086 VIM VIM 7.0.087 VIM VIM 7.0.088 VIM VIM 7.0.089 VIM VIM 7.0.090 VIM VIM 7.0.091 VIM VIM 7.0.092 VIM VIM 7.0.093 VIM VIM 7.0.094 VIM VIM 7.0.095 VIM VIM 7.0.096 VIM VIM 7.0.097 VIM VIM 7.0.098 VIM VIM 7.0.099 VIM VIM 7.0.100 VIM VIM 7.0.101 VIM VIM 7.0.102 VIM VIM 7.0.103 VIM VIM 7.0.104 VIM VIM 7.0.105 VIM VIM 7.0.106 VIM VIM 7.0.107 VIM VIM 7.0.108 VIM VIM 7.0.109 VIM VIM 7.0.110 VIM VIM 7.0.111 VIM VIM 7.0.112 VIM VIM 7.0.113 VIM VIM 7.0.114 VIM VIM 7.0.115 VIM VIM 7.0.116 VIM VIM 7.0.117 VIM VIM 7.0.118 VIM VIM 7.0.119 VIM VIM 7.0.120 VIM VIM 7.0.121 VIM VIM 7.0.122 VIM VIM 7.0.123 VIM VIM 7.0.124 VIM VIM 7.0.125 VIM VIM 7.0.126 VIM VIM 7.0.127 VIM VIM 7.0.128 VIM VIM 7.0.129 VIM VIM 7.0.130 VIM VIM 7.0.131 VIM VIM 7.0.132 VIM VIM 7.0.133 VIM VIM 7.0.134 VIM VIM 7.0.135 VIM VIM 7.0.136 VIM VIM 7.0.137 VIM VIM 7.0.138 VIM VIM 7.0.139 VIM VIM 7.0.140 VIM VIM 7.0.141 VIM VIM 7.0.142 VIM VIM 7.0.143 VIM VIM 7.0.144 VIM VIM 7.0.145 VIM VIM 7.0.146 VIM VIM 7.0.147 VIM VIM 7.0.148 VIM VIM 7.0.149 VIM VIM 7.0.150 VIM VIM 7.0.151 VIM VIM 7.0.152 VIM VIM 7.0.153 VIM VIM 7.0.154 VIM VIM 7.0.155 VIM VIM 7.0.156 VIM VIM 7.0.157 VIM VIM 7.0.158 VIM VIM 7.0.159 VIM VIM 7.0.160 VIM VIM 7.0.161 VIM VIM 7.0.162 VIM VIM 7.0.163 VIM VIM 7.0.164 VIM VIM 7.0.165 VIM VIM 7.0.166 VIM VIM 7.0.167 VIM VIM 7.0.168 VIM VIM 7.0.169 VIM VIM 7.0.170 VIM VIM 7.0.171 VIM VIM 7.0.172 VIM VIM 7.0.173 VIM VIM 7.0.174 VIM VIM 7.0.175 VIM VIM 7.0.176 VIM VIM 7.0.177 VIM VIM 7.0.178 VIM VIM 7.0.179 VIM VIM 7.0.180 VIM VIM 7.0.181 VIM VIM 7.0.182 VIM VIM 7.0.183 VIM VIM 7.0.184 VIM VIM 7.0.185 VIM VIM 7.0.186 VIM VIM 7.0.187 VIM VIM 7.0.188 VIM VIM 7.0.189 VIM VIM 7.0.190 VIM VIM 7.0.191 VIM VIM 7.0.192 VIM VIM 7.0.193 VIM VIM 7.0.194 VIM VIM 7.0.195 VIM VIM 7.0.196 VIM VIM 7.0.197 VIM VIM 7.0.198 VIM VIM 7.0.199 VIM VIM 7.0.200 VIM VIM 7.0.201 VIM VIM 7.0.202 VIM VIM 7.0.203 VIM VIM 7.0.204 VIM VIM 7.0.205 VIM VIM 7.0.206 VIM VIM 7.0.207 VIM VIM 7.0.208 VIM VIM 7.0.209 VIM VIM 7.0.210 VIM VIM 7.0.211 VIM VIM 7.0.212 VIM VIM 7.0.213 VIM VIM 7.0.214 VIM VIM 7.0.215 VIM VIM 7.0.216 VIM VIM 7.0.217 VIM VIM 7.0.218 VIM VIM 7.0.219 VIM VIM 7.0.220 VIM VIM 7.0.221 VIM VIM 7.0.222 VIM VIM 7.0.223 VIM VIM 7.0.224 VIM VIM 7.0.225 VIM VIM 7.0.226 VIM VIM 7.0.227 VIM VIM 7.0.228 VIM VIM 7.0.229 VIM VIM 7.0.230 VIM VIM 7.0.231 VIM VIM 7.0.232 VIM VIM 7.0.233 VIM VIM 7.0.234 VIM VIM 7.0.235 VIM VIM 7.0.236 VIM VIM 7.0.237 VIM VIM 7.0.238 VIM VIM 7.0.239 VIM VIM 7.0.240 VIM VIM 7.0.241 VIM VIM 7.0.242 VIM VIM 7.0.243 VIM VIM 7.0B VIM VIM 7.0B01 VIM VIM 7.0B02 VIM VIM 7.0C VIM VIM 7.0C01 VIM VIM 7.0C02 VIM VIM 7.0C03 VIM VIM 7.0C10 VIM VIM 7.0C11 VIM VIM 7.0C12 VIM VIM 7.0C13 VIM VIM 7.0D VIM VIM 7.0D01 VIM VIM 7.0D02 VIM VIM 7.0D03 VIM VIM 7.0D04 VIM VIM 7.0D05 VIM VIM 7.0E VIM VIM 7.00E\+01 VIM VIM 7.00E\+02 VIM VIM 7.00E\+03 VIM VIM 7.00E\+04 VIM VIM 7.00E\+05 VIM VIM 7.00E\+06 VIM VIM 7.00E\+07 VIM VIM 7.0F VIM VIM 7.0F01 VIM VIM 7.0F02 VIM VIM 7.0F03 VIM VIM 7.0F04 VIM VIM 7.0F05 VIM VIM 7.0G VIM VIM 7.0G01 VIM VIM 7.0G02 VIM VIM 7.0G03 VIM VIM 7.0G04 VIM VIM 7.0G05 VIM VIM 7.01 VIM VIM 7.1 VIM VIM 7.1.001 VIM VIM 7.1.002 VIM VIM 7.1.003 VIM VIM 7.1.004 VIM VIM 7.1.005 VIM VIM 7.1.006 VIM VIM 7.1.007 VIM VIM 7.1.008 VIM VIM 7.1.009 VIM VIM 7.1.010 VIM VIM 7.1.011 VIM VIM 7.1.012 VIM VIM 7.1.013 VIM VIM 7.1.014 VIM VIM 7.1.015 VIM VIM 7.1.016 VIM VIM 7.1.017 VIM VIM 7.1.018 VIM VIM 7.1.019 VIM VIM 7.1.020 VIM VIM 7.1.021 VIM VIM 7.1.022 VIM VIM 7.1.023 VIM VIM 7.1.024 VIM VIM 7.1.025 VIM VIM 7.1.026 VIM VIM 7.1.027 VIM VIM 7.1.028 VIM VIM 7.1.029 VIM VIM 7.1.030 VIM VIM 7.1.031 VIM VIM 7.1.032 VIM VIM 7.1.033 VIM VIM 7.1.034 VIM VIM 7.1.035 VIM VIM 7.1.036 VIM VIM 7.1.037 VIM VIM 7.1.038 VIM VIM 7.1.039 VIM VIM 7.1.040 VIM VIM 7.1.041 VIM VIM 7.1.042 VIM VIM 7.1.043 VIM VIM 7.1.044 VIM VIM 7.1.045 VIM VIM 7.1.046 VIM VIM 7.1.047 VIM VIM 7.1.048 VIM VIM 7.1.049 VIM VIM 7.1.050 VIM VIM 7.1.051 VIM VIM 7.1.052 VIM VIM 7.1.053 VIM VIM 7.1.054 VIM VIM 7.1.055 VIM VIM 7.1.056 VIM VIM 7.1.057 VIM VIM 7.1.058 VIM VIM 7.1.059 VIM VIM 7.1.060 VIM VIM 7.1.061 VIM VIM 7.1.062 VIM VIM 7.1.063 VIM VIM 7.1.064 VIM VIM 7.1.065 VIM VIM 7.1.066 VIM VIM 7.1.067 VIM VIM 7.1.068 VIM VIM 7.1.069 VIM VIM 7.1.070 VIM VIM 7.1.071 VIM VIM 7.1.072 VIM VIM 7.1.073 VIM VIM 7.1.074 VIM VIM 7.1.075 VIM VIM 7.1.076 VIM VIM 7.1.077 VIM VIM 7.1.078 VIM VIM 7.1.079 VIM VIM 7.1.080 VIM VIM 7.1.081 VIM VIM 7.1.082 VIM VIM 7.1.084 VIM VIM 7.1.085 VIM VIM 7.1.086 VIM VIM 7.1.087 VIM VIM 7.1.088 VIM VIM 7.1.089 VIM VIM 7.1.090 VIM VIM 7.1.091 VIM VIM 7.1.092 VIM VIM 7.1.093 VIM VIM 7.1.094 VIM VIM 7.1.095 VIM VIM 7.1.096 VIM VIM 7.1.097 VIM VIM 7.1.098 VIM VIM 7.1.099 VIM VIM 7.1.100 VIM VIM 7.1.101 VIM VIM 7.1.102 VIM VIM 7.1.103 VIM VIM 7.1.104 VIM VIM 7.1.105 VIM VIM 7.1.106 VIM VIM 7.1.107 VIM VIM 7.1.108 VIM VIM 7.1.109 VIM VIM 7.1.110 VIM VIM 7.1.111 VIM VIM 7.1.112 VIM VIM 7.1.113 VIM VIM 7.1.114 VIM VIM 7.1.115 VIM VIM 7.1.116 VIM VIM 7.1.117 VIM VIM 7.1.118 VIM VIM 7.1.119 VIM VIM 7.1.120 VIM VIM 7.1.121 VIM VIM 7.1.122 VIM VIM 7.1.123 VIM VIM 7.1.124 VIM VIM 7.1.125 VIM VIM 7.1.126 VIM VIM 7.1.127 VIM VIM 7.1.128 VIM VIM 7.1.129 VIM VIM 7.1.130 VIM VIM 7.1.131 VIM VIM 7.1.132 VIM VIM 7.1.133 VIM VIM 7.1.134 VIM VIM 7.1.135 VIM VIM 7.1.136 VIM VIM 7.1.137 VIM VIM 7.1.138 VIM VIM 7.1.139 VIM VIM 7.1.140 VIM VIM 7.1.141 VIM VIM 7.1.142 VIM VIM 7.1.143 VIM VIM 7.1.144 VIM VIM 7.1.145 VIM VIM 7.1.146 VIM VIM 7.1.147 VIM VIM 7.1.148 VIM VIM 7.1.149 VIM VIM 7.1.150 VIM VIM 7.1.151 VIM VIM 7.1.152 VIM VIM 7.1.153 VIM VIM 7.1.154 VIM VIM 7.1.155 VIM VIM 7.1.156 VIM VIM 7.1.157 VIM VIM 7.1.158 VIM VIM 7.1.159 VIM VIM 7.1.160 VIM VIM 7.1.161 VIM VIM 7.1.162 VIM VIM 7.1.163 VIM VIM 7.1.164 VIM VIM 7.1.165 VIM VIM 7.1.166 VIM VIM 7.1.167 VIM VIM 7.1.168 VIM VIM 7.1.169 VIM VIM 7.1.170 VIM VIM 7.1.171 VIM VIM 7.1.172 VIM VIM 7.1.173 VIM VIM 7.1.174 VIM VIM 7.1.175 VIM VIM 7.1.176 VIM VIM 7.1.177 VIM VIM 7.1.178 VIM VIM 7.1.179 VIM VIM 7.1.180 VIM VIM 7.1.181 VIM VIM 7.1.182 VIM VIM 7.1.183 VIM VIM 7.1.184 VIM VIM 7.1.185 VIM VIM 7.1.186 VIM VIM 7.1.187 VIM VIM 7.1.188 VIM VIM 7.1.189 VIM VIM 7.1.190 VIM VIM 7.1.191 VIM VIM 7.1.192 VIM VIM 7.1.193 VIM VIM 7.1.194 VIM VIM 7.1.195 VIM VIM 7.1.196 VIM VIM 7.1.197 VIM VIM 7.1.198 VIM VIM 7.1.199 VIM VIM 7.1.200 VIM VIM 7.1.201 VIM VIM 7.1.202 VIM VIM 7.1.203 VIM VIM 7.1.204 VIM VIM 7.1.205 VIM VIM 7.1.206 VIM VIM 7.1.207 VIM VIM 7.1.208 VIM VIM 7.1.209 VIM VIM 7.1.210 VIM VIM 7.1.211 VIM VIM 7.1.212 VIM VIM 7.1.213 VIM VIM 7.1.214 VIM VIM 7.1.215 VIM VIM 7.1.216 VIM VIM 7.1.217 VIM VIM 7.1.218 VIM VIM 7.1.219 VIM VIM 7.1.220 VIM VIM 7.1.221 VIM VIM 7.1.222 VIM VIM 7.1.223 VIM VIM 7.1.224 VIM VIM 7.1.225 VIM VIM 7.1.226 VIM VIM 7.1.227 VIM VIM 7.1.228 VIM VIM 7.1.229 VIM VIM 7.1.230 VIM VIM 7.1.231 VIM VIM 7.1.232 VIM VIM 7.1.233 VIM VIM 7.1.234 VIM VIM 7.1.235 VIM VIM 7.1.236 VIM VIM 7.1.237 VIM VIM 7.1.238 VIM VIM 7.1.239 VIM VIM 7.1.240 VIM VIM 7.1.241 VIM VIM 7.1.242 VIM VIM 7.1.243 VIM VIM 7.1.244 VIM VIM 7.1.245 VIM VIM 7.1.246 VIM VIM 7.1.247 VIM VIM 7.1.248 VIM VIM 7.1.249 VIM VIM 7.1.250 VIM VIM 7.1.251 VIM VIM 7.1.252 VIM VIM 7.1.253 VIM VIM 7.1.254 VIM VIM 7.1.255 VIM VIM 7.1.256 VIM VIM 7.1.257 VIM VIM 7.1.258 VIM VIM 7.1.259 VIM VIM 7.1.260 VIM VIM 7.1.261 VIM VIM 7.1.262 VIM VIM 7.1.263 VIM VIM 7.1.264 VIM VIM 7.1.265 VIM VIM 7.1.266 VIM VIM 7.1.267 VIM VIM 7.1.268 VIM VIM 7.1.269 VIM VIM 7.1.270 VIM VIM 7.1.271 VIM VIM 7.1.272 VIM VIM 7.1.273 VIM VIM 7.1.274 VIM VIM 7.1.275 VIM VIM 7.1.276 VIM VIM 7.1.277 VIM VIM 7.1.278 VIM VIM 7.1.279 VIM VIM 7.1.280 VIM VIM 7.1.281 VIM VIM 7.1.282 VIM VIM 7.1.283 VIM VIM 7.1.284 VIM VIM 7.1.285 VIM VIM 7.1.286 VIM VIM 7.1.287 VIM VIM 7.1.288 VIM VIM 7.1.289 VIM VIM 7.1.290 VIM VIM 7.1.291 VIM VIM 7.1.292 VIM VIM 7.1.293 VIM VIM 7.1.294 VIM VIM 7.1.295 VIM VIM 7.1.296 VIM VIM 7.1.297 VIM VIM 7.1.298 VIM VIM 7.1.299 VIM VIM 7.1.300 VIM VIM 7.1.301 VIM VIM 7.1.302 VIM VIM 7.1.303 VIM VIM 7.1.304 VIM VIM 7.1.305 VIM VIM 7.1.306 VIM VIM 7.1.307 VIM VIM 7.1.308 VIM VIM 7.1.309 VIM VIM 7.1.310 VIM VIM 7.1.311 VIM VIM 7.1.312 VIM VIM 7.1.313 VIM VIM 7.1.314	600
OS	Canonical Canonical Ubuntu Linux 6.06 Canonical Ubuntu Linux 7.10 Canonical Ubuntu Linux 8.04 Canonical Ubuntu Linux 8.10	4

Common Weakness Enumeration (CWE)

CWE-20 - Improper Input Validation

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Server Side Include (SSI) Injection
An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
Cross Site Scripting through Log Files
An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
Command Line Execution through SQL Injection
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Exploit-Db

description	Vim 7.x Vim Script Multiple Command Execution Vulnerabilities. CVE-2008-2712. Local exploit for linux platform
id	EDB-ID:31911
last seen	2016-02-03
modified	2008-06-14
published	2008-06-14
reporter	Jan Minar
source	https://www.exploit-db.com/download/31911/
title	Vim 7.x - Vim Script Multiple Command Execution Vulnerabilities

Nessus

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20081125_VIM_ON_SL3_X.NASL
description	Several input sanitization flaws were found in Vim
last seen	2020-06-01
modified	2020-06-02
plugin id	60500
published	2012-08-01
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/60500
title	Scientific Linux Security Update : vim on SL3.x, SL4.x, SL5.x i386/x86_64
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text is (C) Scientific Linux. # include("compat.inc"); if (description) { script_id(60500); script_version("1.6"); script_cvs_date("Date: 2019/10/25 13:36:18"); script_cve_id("CVE-2007-2953", "CVE-2008-2712", "CVE-2008-3074", "CVE-2008-3075", "CVE-2008-3076", "CVE-2008-3432", "CVE-2008-4101"); script_name(english:"Scientific Linux Security Update : vim on SL3.x, SL4.x, SL5.x i386/x86_64"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Scientific Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Several input sanitization flaws were found in Vim's keyword and tag handling. If Vim looked up a document's maliciously crafted tag or keyword, it was possible to execute arbitrary code as the user running Vim. (CVE-2008-4101) SL3 and SL4 Only: A heap-based overflow flaw was discovered in Vim's expansion of file name patterns with shell wildcards. An attacker could create a specially crafted file or directory name that, when opened by Vim, caused the application to crash or, possibly, execute arbitrary code. (CVE-2008-3432) SL5 Only: Multiple security flaws were found in netrw.vim, the Vim plug-in providing file reading and writing over the network. If a user opened a specially crafted file or directory with the netrw plug-in, it could result in arbitrary code execution as the user running Vim. (CVE-2008-3076) SL5 Only: A security flaw was found in zip.vim, the Vim plug-in that handles ZIP archive browsing. If a user opened a ZIP archive using the zip.vim plug-in, it could result in arbitrary code execution as the user running Vim. (CVE-2008-3075) SL5 Only: A security flaw was found in tar.vim, the Vim plug-in which handles TAR archive browsing. If a user opened a TAR archive using the tar.vim plug-in, it could result in arbitrary code execution as the user runnin Vim. (CVE-2008-3074) Several input sanitization flaws were found in various Vim system functions. If a user opened a specially crafted file, it was possible to execute arbitrary code as the user running Vim. (CVE-2008-2712) Ulf Härnhammar, of Secunia Research, discovered a format string flaw in Vim's help tag processor. If a user was tricked into executing the 'helptags' command on malicious data, arbitrary code could be executed with the permissions of the user running Vim. (CVE-2007-2953)" ); # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0811&L=scientific-linux-errata&T=0&P=1936 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?7ee91c3b" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(20, 78, 94, 119); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux"); script_set_attribute(attribute:"patch_publication_date", value:"2008/11/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Scientific Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux"); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu); flag = 0; if (rpm_check(release:"SL3", reference:"vim-X11-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"SL3", reference:"vim-common-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"SL3", reference:"vim-enhanced-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"SL3", reference:"vim-minimal-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"SL4", reference:"vim-X11-6.3.046-1.el4_7.5z")) flag++; if (rpm_check(release:"SL4", reference:"vim-common-6.3.046-1.el4_7.5z")) flag++; if (rpm_check(release:"SL4", reference:"vim-enhanced-6.3.046-1.el4_7.5z")) flag++; if (rpm_check(release:"SL4", reference:"vim-minimal-6.3.046-1.el4_7.5z")) flag++; if (rpm_check(release:"SL5", reference:"vim-X11-7.0.109-4.el5_2.4z")) flag++; if (rpm_check(release:"SL5", reference:"vim-common-7.0.109-4.el5_2.4z")) flag++; if (rpm_check(release:"SL5", reference:"vim-enhanced-7.0.109-4.el5_2.4z")) flag++; if (rpm_check(release:"SL5", reference:"vim-minimal-7.0.109-4.el5_2.4z")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2008-236.NASL
description	Several vulnerabilities were found in the vim editor : A number of input sanitization flaws were found in various vim system functions. If a user were to open a specially crafted file, it would be possible to execute arbitrary code as the user running vim (CVE-2008-2712). Ulf HÃ¤rnhammar of Secunia Research found a format string flaw in vim
last seen	2020-06-01
modified	2020-06-02
plugin id	36821
published	2009-04-23
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/36821
title	Mandriva Linux Security Advisory : vim (MDVSA-2008:236-1)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandriva Linux Security Advisory MDVSA-2008:236. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(36821); script_version ("1.15"); script_cvs_date("Date: 2019/08/02 13:32:50"); script_cve_id("CVE-2007-2953", "CVE-2008-2712", "CVE-2008-2953", "CVE-2008-3074", "CVE-2008-3075", "CVE-2008-3076", "CVE-2008-4101", "CVE-2008-4677"); script_bugtraq_id(25095); script_xref(name:"MDVSA", value:"2008:236-1"); script_name(english:"Mandriva Linux Security Advisory : vim (MDVSA-2008:236-1)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandriva Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Several vulnerabilities were found in the vim editor : A number of input sanitization flaws were found in various vim system functions. If a user were to open a specially crafted file, it would be possible to execute arbitrary code as the user running vim (CVE-2008-2712). Ulf HÃ¤rnhammar of Secunia Research found a format string flaw in vim's help tags processor. If a user were tricked into executing the helptags command on malicious data, it could result in the execution of arbitrary code as the user running vim (CVE-2008-2953). A flaw was found in how tar.vim handled TAR archive browsing. If a user were to open a special TAR archive using the plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3074). A flaw was found in how zip.vim handled ZIP archive browsing. If a user were to open a special ZIP archive using the plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3075). A number of security flaws were found in netrw.vim, the vim plugin that provides the ability to read and write files over the network. If a user opened a specially crafted file or directory with the netrw plugin, it could result in the execution of arbitrary code as the user running vim (CVE-2008-3076). A number of input validation flaws were found in vim's keyword and tag handling. If vim looked up a document's maliciously crafted tag or keyword, it was possible to execute arbitary code as the user running vim (CVE-2008-4101). A vulnerability was found in certain versions of netrw.vim where it would send FTP credentials stored for an FTP session to subsequent FTP sessions to servers on different hosts, exposing FTP credentials to remote hosts (CVE-2008-4677). This update provides vim 7.2 (patchlevel 65) which corrects all of these issues and introduces a number of new features and bug fixes. Update : The previous vim update incorrectly introduced a requirement on libruby and also conflicted with a file from the git-core package (in contribs). These issues have been corrected with these updated packages." ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(20, 78, 94, 255); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:vim-X11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:vim-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:vim-enhanced"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:vim-minimal"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2008.0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2008.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2009.0"); script_set_attribute(attribute:"patch_publication_date", value:"2008/12/08"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/04/23"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64\|i[3-6]86\|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK2008.0", reference:"vim-X11-7.2.065-9.3mdv2008.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2008.0", reference:"vim-common-7.2.065-9.3mdv2008.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2008.0", reference:"vim-enhanced-7.2.065-9.3mdv2008.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2008.0", reference:"vim-minimal-7.2.065-9.3mdv2008.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2008.1", reference:"vim-X11-7.2.065-9.3mdv2008.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2008.1", reference:"vim-common-7.2.065-9.3mdv2008.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2008.1", reference:"vim-enhanced-7.2.065-9.3mdv2008.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2008.1", reference:"vim-minimal-7.2.065-9.3mdv2008.1", yank:"mdv")) flag++; if (rpm_check(release:"MDK2009.0", reference:"vim-X11-7.2.065-9.3mdv2009.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2009.0", reference:"vim-common-7.2.065-9.3mdv2009.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2009.0", reference:"vim-enhanced-7.2.065-9.3mdv2009.0", yank:"mdv")) flag++; if (rpm_check(release:"MDK2009.0", reference:"vim-minimal-7.2.065-9.3mdv2009.0", yank:"mdv")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2008-0617.NASL
description	From Red Hat Security Advisory 2008:0617 : Updated vim packages that fix various security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. Several input sanitization flaws were found in Vim
last seen	2020-06-01
modified	2020-06-02
plugin id	67732
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/67732
title	Oracle Linux 3 / 4 : vim (ELSA-2008-0617)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2008:0617 and # Oracle Linux Security Advisory ELSA-2008-0617 respectively. # include("compat.inc"); if (description) { script_id(67732); script_version("1.12"); script_cvs_date("Date: 2019/10/25 13:36:07"); script_cve_id("CVE-2007-2953", "CVE-2008-2712", "CVE-2008-3432", "CVE-2008-4101"); script_xref(name:"RHSA", value:"2008:0617"); script_name(english:"Oracle Linux 3 / 4 : vim (ELSA-2008-0617)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Oracle Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "From Red Hat Security Advisory 2008:0617 : Updated vim packages that fix various security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. Several input sanitization flaws were found in Vim's keyword and tag handling. If Vim looked up a document's maliciously crafted tag or keyword, it was possible to execute arbitrary code as the user running Vim. (CVE-2008-4101) A heap-based overflow flaw was discovered in Vim's expansion of file name patterns with shell wildcards. An attacker could create a specially crafted file or directory name that, when opened by Vim, caused the application to crash or, possibly, execute arbitrary code. (CVE-2008-3432) Several input sanitization flaws were found in various Vim system functions. If a user opened a specially crafted file, it was possible to execute arbitrary code as the user running Vim. (CVE-2008-2712) Ulf Harnhammar, of Secunia Research, discovered a format string flaw in Vim's help tag processor. If a user was tricked into executing the 'helptags' command on malicious data, arbitrary code could be executed with the permissions of the user running Vim. (CVE-2007-2953) All Vim users are advised to upgrade to these updated packages, which contain backported patches to correct these issues." ); script_set_attribute( attribute:"see_also", value:"https://oss.oracle.com/pipermail/el-errata/2008-November/000814.html" ); script_set_attribute( attribute:"see_also", value:"https://oss.oracle.com/pipermail/el-errata/2008-November/000815.html" ); script_set_attribute(attribute:"solution", value:"Update the affected vim packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(20, 119); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:vim-X11"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:vim-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:vim-enhanced"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:vim-minimal"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:3"); script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:4"); script_set_attribute(attribute:"vuln_publication_date", value:"2007/07/31"); script_set_attribute(attribute:"patch_publication_date", value:"2008/11/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Oracle Linux Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux"); release = get_kb_item("Host/RedHat/release"); if (isnull(release) \|\| !pregmatch(pattern: "Oracle (?:Linux Server\|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux"); os_ver = pregmatch(pattern: "Oracle (?:Linux Server\|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux"); os_ver = os_ver[1]; if (! preg(pattern:"^(3\|4)([^0-9]\|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 3 / 4", "Oracle Linux " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu); flag = 0; if (rpm_check(release:"EL3", cpu:"i386", reference:"vim-X11-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"EL3", cpu:"x86_64", reference:"vim-X11-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"EL3", cpu:"i386", reference:"vim-common-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"EL3", cpu:"x86_64", reference:"vim-common-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"EL3", cpu:"i386", reference:"vim-enhanced-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"EL3", cpu:"x86_64", reference:"vim-enhanced-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"EL3", cpu:"i386", reference:"vim-minimal-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"EL3", cpu:"x86_64", reference:"vim-minimal-6.3.046-0.30E.11")) flag++; if (rpm_check(release:"EL4", reference:"vim-X11-6.3.046-1.el4_7.5z")) flag++; if (rpm_check(release:"EL4", reference:"vim-common-6.3.046-1.el4_7.5z")) flag++; if (rpm_check(release:"EL4", reference:"vim-enhanced-6.3.046-1.el4_7.5z")) flag++; if (rpm_check(release:"EL4", reference:"vim-minimal-6.3.046-1.el4_7.5z")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "vim-X11 / vim-common / vim-enhanced / vim-minimal"); }

NASL family	SuSE Local Security Checks
NASL id	SUSE_GVIM-6025.NASL
description	The VI Improved editor (vim) received bugfixes for some code execution problems. - Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fix ed. CVE-2008-4101: Arbitrary code execution when pressing K, ctrl-] or g] depending on the text under the cursor. (CVE-2008-2712)
last seen	2020-06-01
modified	2020-06-02
plugin id	41519
published	2009-09-24
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/41519
title	SuSE 10 Security Update : vim (ZYPP Patch Number 6025)
code	#%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # include("compat.inc"); if (description) { script_id(41519); script_version ("1.10"); script_cvs_date("Date: 2019/10/25 13:36:36"); script_cve_id("CVE-2008-2712", "CVE-2008-4101"); script_name(english:"SuSE 10 Security Update : vim (ZYPP Patch Number 6025)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 10 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "The VI Improved editor (vim) received bugfixes for some code execution problems. - Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fix ed. CVE-2008-4101: Arbitrary code execution when pressing K, ctrl-] or g] depending on the text under the cursor. (CVE-2008-2712)" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-2712.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2008-4101.html" ); script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 6025."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_cwe_id(20); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"patch_publication_date", value:"2009/02/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/09/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2019 Tenable Network Security, Inc."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SLED10", sp:2, reference:"gvim-6.4.6-19.15")) flag++; if (rpm_check(release:"SLED10", sp:2, reference:"vim-6.4.6-19.15")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"gvim-6.4.6-19.15")) flag++; if (rpm_check(release:"SLES10", sp:2, reference:"vim-6.4.6-19.15")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else exit(0, "The host is not affected.");

NASL family	VMware ESX Local Security Checks
NASL id	VMWARE_VMSA-2009-0004.NASL
description	a. Updated OpenSSL package for the Service Console fixes a security issue. OpenSSL 0.9.7a-33.24 and earlier does not properly check the return value from the EVP_VerifyFinal function, which could allow a remote attacker to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-5077 to this issue. b. Update bind package for the Service Console fixes a security issue. A flaw was discovered in the way Berkeley Internet Name Domain (BIND) checked the return value of the OpenSSL DSA_do_verify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-0025 to this issue. c. Updated vim package for the Service Console addresses several security issues. Several input flaws were found in Visual editor IMproved
last seen	2020-06-01
modified	2020-06-02
plugin id	40389
published	2009-07-27
reporter	This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/40389
title	VMSA-2009-0004 : ESX Service Console updates for openssl, bind, and vim
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from VMware Security Advisory 2009-0004. # The text itself is copyright (C) VMware Inc. # include("compat.inc"); if (description) { script_id(40389); script_version("1.28"); script_cvs_date("Date: 2018/08/06 14:03:16"); script_cve_id("CVE-2007-2953", "CVE-2008-2712", "CVE-2008-3432", "CVE-2008-4101", "CVE-2008-5077", "CVE-2009-0021", "CVE-2009-0025", "CVE-2009-0046", "CVE-2009-0047", "CVE-2009-0048", "CVE-2009-0049", "CVE-2009-0050", "CVE-2009-0051", "CVE-2009-0124", "CVE-2009-0125", "CVE-2009-0127", "CVE-2009-0128", "CVE-2009-0130"); script_bugtraq_id(25095, 33150, 33151); script_xref(name:"VMSA", value:"2009-0004"); script_name(english:"VMSA-2009-0004 : ESX Service Console updates for openssl, bind, and vim"); script_summary(english:"Checks esxupdate output for the patches"); script_set_attribute( attribute:"synopsis", value: "The remote VMware ESX host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "a. Updated OpenSSL package for the Service Console fixes a security issue. OpenSSL 0.9.7a-33.24 and earlier does not properly check the return value from the EVP_VerifyFinal function, which could allow a remote attacker to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-5077 to this issue. b. Update bind package for the Service Console fixes a security issue. A flaw was discovered in the way Berkeley Internet Name Domain (BIND) checked the return value of the OpenSSL DSA_do_verify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-0025 to this issue. c. Updated vim package for the Service Console addresses several security issues. Several input flaws were found in Visual editor IMproved's (Vim) keyword and tag handling. If Vim looked up a document's maliciously crafted tag or keyword, it was possible to execute arbitrary code as the user running Vim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-4101 to this issue. A heap-based overflow flaw was discovered in Vim's expansion of file name patterns with shell wildcards. An attacker could create a specially crafted file or directory name, when opened by Vim causes the application to stop responding or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-3432 to this issue. Several input flaws were found in various Vim system functions. If a user opened a specially crafted file, it was possible to execute arbitrary code as the user running Vim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2008-2712 to this issue. A format string flaw was discovered in Vim's help tag processor. If a user was tricked into executing the 'helptags' command on malicious data, arbitrary code could be executed with the permissions of the user running VIM. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2007-2953 to this issue." ); script_set_attribute( attribute:"see_also", value:"http://lists.vmware.com/pipermail/security-announce/2010/000077.html" ); script_set_attribute(attribute:"solution", value:"Apply the missing patches."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_cwe_id(20, 119, 287); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:2.5.5"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:3.0.2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:3.0.3"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:3.5"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:esx:4.0"); script_set_attribute(attribute:"patch_publication_date", value:"2009/03/31"); script_set_attribute(attribute:"plugin_publication_date", value:"2009/07/27"); script_set_attribute(attribute:"vuln_publication_date", value:"2007/07/27"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc."); script_family(english:"VMware ESX Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/VMware/release", "Host/VMware/version"); script_require_ports("Host/VMware/esxupdate", "Host/VMware/esxcli_software_vibs"); exit(0); } include("audit.inc"); include("vmware_esx_packages.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/VMware/release")) audit(AUDIT_OS_NOT, "VMware ESX / ESXi"); if ( !get_kb_item("Host/VMware/esxcli_software_vibs") && !get_kb_item("Host/VMware/esxupdate") ) audit(AUDIT_PACKAGE_LIST_MISSING); init_esx_check(date:"2009-03-31"); flag = 0; if (esx_check(ver:"ESX 2.5.5", patch:"13")) flag++; if (esx_check(ver:"ESX 3.0.2", patch:"ESX-1008406")) flag++; if (esx_check(ver:"ESX 3.0.2", patch:"ESX-1008408")) flag++; if (esx_check(ver:"ESX 3.0.2", patch:"ESX-1008409")) flag++; if ( esx_check( ver : "ESX 3.0.3", patch : "ESX303-200903403-SG", patch_updates : make_list("ESX303-Rollup01", "ESX303-Update01") ) ) flag++; if ( esx_check( ver : "ESX 3.0.3", patch : "ESX303-200903405-SG", patch_updates : make_list("ESX303-Rollup01", "ESX303-Update01") ) ) flag++; if ( esx_check( ver : "ESX 3.0.3", patch : "ESX303-200903406-SG", patch_updates : make_list("ESX303-Rollup01", "ESX303-Update01") ) ) flag++; if ( esx_check( ver : "ESX 3.5.0", patch : "ESX350-200904406-SG", patch_updates : make_list("ESX350-Update05", "ESX350-Update05a") ) ) flag++; if ( esx_check( ver : "ESX 3.5.0", patch : "ESX350-200904407-SG", patch_updates : make_list("ESX350-201002404-SG", "ESX350-Update05", "ESX350-Update05a") ) ) flag++; if ( esx_check( ver : "ESX 3.5.0", patch : "ESX350-200904408-SG", patch_updates : make_list("ESX350-201012401-SG", "ESX350-Update05", "ESX350-Update05a") ) ) flag++; if ( esx_check( ver : "ESX 4.0", patch : "ESX400-200912402-SG", patch_updates : make_list("ESX400-Update02", "ESX400-Update03", "ESX400-Update04") ) ) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:esx_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2008-0618.NASL
description	Updated vim packages that fix security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. Several input sanitization flaws were found in Vim
last seen	2020-06-01
modified	2020-06-02
plugin id	34955
published	2008-11-25
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34955
title	RHEL 2.1 : vim (RHSA-2008:0618)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_SECUPD2008-007.NASL
description	The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. This security update contains fixes for the following products : - Apache - Certificates - ClamAV - ColorSync - CUPS - Finder - launchd - libxslt - MySQL Server - Networking - PHP - Postfix - PSNormalizer - QuickLook - rlogin - Script Editor - Single Sign-On - Tomcat - vim - Weblog
last seen	2020-06-01
modified	2020-06-02
plugin id	34374
published	2008-10-10
reporter	This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/34374
title	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_0_GVIM-090225.NASL
description	The VI Improved editor (vim) was updated to version 7.2.108 to fix various security problems and other bugs. CVE-2008-4677: The netrw plugin sent credentials to all servers. CVE-2009-0316: The python support used a search path including the current directory, allowing code injection when python code was used. CVE-2008-2712: Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fixed. CVE-2008-3074: tarplugin code injection CVE-2008-3075: zipplugin code injection CVE-2008-3076: several netrw bugs, code injection CVE-2008-6235: code injection in the netrw plugin CVE-2008-4677: credential disclosure by netrw plugin
last seen	2020-06-01
modified	2020-06-02
plugin id	39980
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/39980
title	openSUSE Security Update : gvim (gvim-561)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2008-0580.NASL
description	Updated vim packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. Several input sanitization flaws were found in Vim
last seen	2020-06-01
modified	2020-06-02
plugin id	34953
published	2008-11-25
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34953
title	RHEL 5 : vim (RHSA-2008:0580)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_30866E6C3C6D11DD98C900163E000016.NASL
description	Rdancer.org reports : Improper quoting in some parts of Vim written in the Vim Script can lead to arbitrary code execution upon opening a crafted file.
last seen	2020-06-01
modified	2020-06-02
plugin id	33240
published	2008-06-24
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/33240
title	FreeBSD : vim -- Vim Shell Command Injection Vulnerabilities (30866e6c-3c6d-11dd-98c9-00163e000016)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-712-1.NASL
description	Jan Minar discovered that Vim did not properly sanitize inputs before invoking the execute or system functions inside Vim scripts. If a user were tricked into running Vim scripts with a specially crafted input, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2712) Ben Schmidt discovered that Vim did not properly escape characters when performing keyword or tag lookups. If a user were tricked into running specially crafted commands, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-4101). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	38044
published	2009-04-23
reporter	Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/38044
title	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : vim vulnerabilities (USN-712-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE9_12360.NASL
description	The VI Improved editor (vim) received bugfixes for some code execution problems. - Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fixed. (CVE-2008-2712) - Arbitrary code execution when pressing K, ctrl-] or g] depending on the text under the cursor. (CVE-2008-4101) - The netrw plugin sent credentials to all servers. (CVE-2008-4677)
last seen	2020-06-01
modified	2020-06-02
plugin id	41283
published	2009-09-24
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/41283
title	SuSE9 Security Update : ViM (YOU Patch Number 12360)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2008-0617.NASL
description	Updated vim packages that fix various security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. Several input sanitization flaws were found in Vim
last seen	2020-06-01
modified	2020-06-02
plugin id	37794
published	2009-04-23
reporter	This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/37794
title	CentOS 3 / 4 : vim (CESA-2008:0617)

NASL family	SuSE Local Security Checks
NASL id	SUSE_GVIM-6023.NASL
description	The VI Improved editor (vim) was updated to version 7.2.108 to fix various security problems and other bugs. CVE-2008-4677: The netrw plugin sent credentials to all servers. CVE-2009-0316: The python support used a search path including the current directory, allowing code injection when python code was used. CVE-2008-2712: Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fixed. CVE-2008-3074: tarplugin code injection CVE-2008-3075: zipplugin code injection CVE-2008-3076: several netrw bugs, code injection CVE-2008-6235: code injection in the netrw plugin CVE-2008-4677: credential disclosure by netrw plugin
last seen	2020-06-01
modified	2020-06-02
plugin id	35921
published	2009-03-13
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/35921
title	openSUSE 10 Security Update : gvim (gvim-6023)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_SECUPD2010-002.NASL
description	The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied. This security update contains fixes for the following products : - AppKit - Application Firewall - AFP Server - Apache - ClamAV - CoreTypes - CUPS - curl - Cyrus IMAP - Cyrus SASL - Disk Images - Directory Services - Event Monitor - FreeRADIUS - FTP Server - iChat Server - Image RAW - Libsystem - Mail - Mailman - OS Services - Password Server - perl - PHP - PS Normalizer - Ruby - Server Admin - SMB - Tomcat - unzip - vim - Wiki Server - X11 - xar
last seen	2020-06-01
modified	2020-06-02
plugin id	45373
published	2010-03-29
reporter	This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/45373
title	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2008-0580.NASL
description	Updated vim packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. Several input sanitization flaws were found in Vim
last seen	2020-06-01
modified	2020-06-02
plugin id	43697
published	2010-01-06
reporter	This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/43697
title	CentOS 5 : vim (CESA-2008:0580)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-1733.NASL
description	Several vulnerabilities have been found in vim, an enhanced vi editor. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-2712 Jan Minar discovered that vim did not properly sanitise inputs before invoking the execute or system functions inside vim scripts. This could lead to the execution of arbitrary code. - CVE-2008-3074 Jan Minar discovered that the tar plugin of vim did not properly sanitise the filenames in the tar archive or the name of the archive file itself, making it prone to arbitrary code execution. - CVE-2008-3075 Jan Minar discovered that the zip plugin of vim did not properly sanitise the filenames in the zip archive or the name of the archive file itself, making it prone to arbitrary code execution. - CVE-2008-3076 Jan Minar discovered that the netrw plugin of vim did not properly sanitise the filenames or directory names it is given. This could lead to the execution of arbitrary code. - CVE-2008-4101 Ben Schmidt discovered that vim did not properly escape characters when performing keyword or tag lookups. This could lead to the execution of arbitrary code.
last seen	2020-06-01
modified	2020-06-02
plugin id	35764
published	2009-03-04
reporter	This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/35764
title	Debian DSA-1733-1 : vim - several vulnerabilities

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_1_GVIM-090225.NASL
description	The VI Improved editor (vim) was updated to version 7.2.108 to fix various security problems and other bugs. CVE-2008-4677: The netrw plugin sent credentials to all servers. CVE-2009-0316: The python support used a search path including the current directory, allowing code injection when python code was used. CVE-2008-2712: Arbitrary code execution in vim helper plugins filetype.vim, zipplugin, xpm.vim, gzip_vim, and netrw were fixed. CVE-2008-3074: tarplugin code injection CVE-2008-3075: zipplugin code injection CVE-2008-3076: several netrw bugs, code injection CVE-2008-6235: code injection in the netrw plugin CVE-2008-4677: credential disclosure by netrw plugin
last seen	2020-06-01
modified	2020-06-02
plugin id	40230
published	2009-07-21
reporter	This script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/40230
title	openSUSE Security Update : gvim (gvim-561)

NASL family	Misc.
NASL id	VMWARE_VMSA-2009-0004_REMOTE.NASL
description	The remote VMware ESX host is missing a security-related patch. It is, therefore, is affected by multiple vulnerabilities : - A format string flaw exists in the Vim help tag processor in the helptags_one() function that allows a remote attacker to execute arbitrary code by tricking a user into executing the
last seen	2020-06-01
modified	2020-06-02
plugin id	89112
published	2016-03-03
reporter	This script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/89112
title	VMware ESX Multiple Vulnerabilities (VMSA-2009-0004) (remote check)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2008-0617.NASL
description	Updated vim packages that fix various security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. Several input sanitization flaws were found in Vim
last seen	2020-06-01
modified	2020-06-02
plugin id	34954
published	2008-11-25
reporter	This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/34954
title	RHEL 3 / 4 : vim (RHSA-2008:0617)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2008-0580.NASL
description	From Red Hat Security Advisory 2008:0580 : Updated vim packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. Several input sanitization flaws were found in Vim
last seen	2020-06-01
modified	2020-06-02
plugin id	67722
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/67722
title	Oracle Linux 5 : vim (ELSA-2008-0580)

Oval

accepted

2013-04-29T04:11:34.446-04:00

class

vulnerability

contributors

name Aharon Chernin
organization SCAP.com, LLC
name Dragos Prisaca
organization G2, Inc.

definition_extensions

comment The operating system installed on the system is Red Hat Enterprise Linux 3
oval oval:org.mitre.oval:def:11782
comment CentOS Linux 3.x
oval oval:org.mitre.oval:def:16651
comment The operating system installed on the system is Red Hat Enterprise Linux 4
oval oval:org.mitre.oval:def:11831
comment CentOS Linux 4.x
oval oval:org.mitre.oval:def:16636
comment Oracle Linux 4.x
oval oval:org.mitre.oval:def:15990
comment The operating system installed on the system is Red Hat Enterprise Linux 5
oval oval:org.mitre.oval:def:11414
comment The operating system installed on the system is CentOS Linux 5.x
oval oval:org.mitre.oval:def:15802
comment Oracle Linux 5.x
oval oval:org.mitre.oval:def:15459

description

family

unix

oval:org.mitre.oval:def:11109

status

accepted

submitted

2010-07-09T03:56:16-04:00

title

version

accepted

2009-11-30T04:00:26.010-05:00

class

vulnerability

contributors

name Michael Wood
organization Hewlett-Packard
name Michael Wood
organization Hewlett-Packard

definition_extensions

comment VMWare ESX Server 3.0.3 is installed
oval oval:org.mitre.oval:def:6026
comment VMWare ESX Server 3.0.2 is installed
oval oval:org.mitre.oval:def:5613
comment VMware ESX Server 3.5.0 is installed
oval oval:org.mitre.oval:def:5887

description

family

unix

oval:org.mitre.oval:def:6238

status

accepted

submitted

2009-09-23T15:39:02.000-04:00

title

Vim Flaw in Quoting Vim Script Lets Remote Users Cause Arbitrary Commands to Be Executed in Certain Cases

version

Redhat

advisories

rhsa
id RHSA-2008:0580
rhsa
id RHSA-2008:0617
rhsa
id RHSA-2008:0618

rpms

vim-X11-2:7.0.109-4.el5_2.4z
vim-common-2:7.0.109-4.el5_2.4z
vim-debuginfo-2:7.0.109-4.el5_2.4z
vim-enhanced-2:7.0.109-4.el5_2.4z
vim-minimal-2:7.0.109-4.el5_2.4z
vim-X11-1:6.3.046-0.30E.11
vim-X11-1:6.3.046-1.el4_7.5z
vim-common-1:6.3.046-0.30E.11
vim-common-1:6.3.046-1.el4_7.5z
vim-debuginfo-1:6.3.046-0.30E.11
vim-debuginfo-1:6.3.046-1.el4_7.5z
vim-enhanced-1:6.3.046-0.30E.11
vim-enhanced-1:6.3.046-1.el4_7.5z
vim-minimal-1:6.3.046-0.30E.11
vim-minimal-1:6.3.046-1.el4_7.5z
vim-X11-1:6.0-7.25
vim-common-1:6.0-7.25
vim-enhanced-1:6.0-7.25
vim-minimal-1:6.0-7.25

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit-Db

Nessus

Oval

Redhat

References