CVEvulnerability
CVE-2008-3076
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-02-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.
Affected configurations
• vim vim 7.2a.10
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919 bugs.debian.org
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html lists.opensuse.org
- http://marc.info/?l=bugtraq&m=121494431426308&w=2 marc.info
- http://marc.info/?l=oss-security&m=122416184431388&w=2 Exploit
- http://secunia.com/advisories/34418 secunia.com
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324 wiki.rpath.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:236 www.mandriva.com
- http://www.openwall.com/lists/oss-security/2008/07/07/1 Exploit
- http://www.openwall.com/lists/oss-security/2008/07/07/4 Exploit, Patch
- http://www.openwall.com/lists/oss-security/2008/07/08/12 www.openwall.com
- http://www.openwall.com/lists/oss-security/2008/10/20/2 www.openwall.com
- http://www.rdancer.org/vulnerablevim-netrw.html Exploit, Patch, Vendor Advisory
- http://www.rdancer.org/vulnerablevim-netrw.v2.html Exploit, Patch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0580.html www.redhat.com
- http://www.securityfocus.com/bid/30115 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43624 exchange.xforce.ibmcloud.com
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919 bugs.debian.org
- http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html lists.opensuse.org
- http://marc.info/?l=bugtraq&m=121494431426308&w=2 marc.info
- http://marc.info/?l=oss-security&m=122416184431388&w=2 Exploit
- http://secunia.com/advisories/34418 secunia.com
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324 wiki.rpath.com
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:236 www.mandriva.com
- http://www.openwall.com/lists/oss-security/2008/07/07/1 Exploit
- http://www.openwall.com/lists/oss-security/2008/07/07/4 Exploit, Patch
- http://www.openwall.com/lists/oss-security/2008/07/08/12 www.openwall.com
- http://www.openwall.com/lists/oss-security/2008/10/20/2 www.openwall.com
- http://www.rdancer.org/vulnerablevim-netrw.html Exploit, Patch, Vendor Advisory
- http://www.rdancer.org/vulnerablevim-netrw.v2.html Exploit, Patch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0580.html www.redhat.com
- http://www.securityfocus.com/bid/30115 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43624 exchange.xforce.ibmcloud.com