CVE-2008-3076

Published: Feb 21, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

The Netrw plugin 125 in netrw.vim in Vim 7.2a.10 allows user-assisted attackers to execute arbitrary code via shell metacharacters in filenames used by the execute and system functions within the (1) mz and (2) mc commands, as demonstrated by the netrw.v2 and netrw.v3 test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712.

Affected (1)

Products: Vim: Vim

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vim Vim	Version 7.2a.10

Related CWEs

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (32)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=121494431426308&w=2

Source: cve@mitre.org

http://marc.info/?l=oss-security&m=122416184431388&w=2

Source: cve@mitre.org

Exploit

http://secunia.com/advisories/34418

Source: cve@mitre.org

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2008:236

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/07/07/1

Source: cve@mitre.org

Exploit

http://www.openwall.com/lists/oss-security/2008/07/07/4

Source: cve@mitre.org

ExploitPatch

http://www.openwall.com/lists/oss-security/2008/07/08/12

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/10/20/2

Source: cve@mitre.org

http://www.rdancer.org/vulnerablevim-netrw.html

Source: cve@mitre.org

ExploitPatchVendor Advisory

http://www.rdancer.org/vulnerablevim-netrw.v2.html

Source: cve@mitre.org

ExploitPatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0580.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/30115

Source: cve@mitre.org

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/43624

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=121494431426308&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=oss-security&m=122416184431388&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/34418

Source: af854a3a-2127-422b-91ae-364da2661108

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2008:236

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/07/07/1

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.openwall.com/lists/oss-security/2008/07/07/4

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

http://www.openwall.com/lists/oss-security/2008/07/08/12

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2008/10/20/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.rdancer.org/vulnerablevim-netrw.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

http://www.rdancer.org/vulnerablevim-netrw.v2.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0580.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/30115

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/43624

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.