CVE-2008-4101

Published: Sep 18, 2008Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Vim 3.0 through 7.x before 7.2.010 does not properly escape characters, which allows user-assisted attackers to (1) execute arbitrary shell commands by entering a K keystroke on a line that contains a ";" (semicolon) followed by a command, or execute arbitrary Ex commands by entering an argument after a (2) "Ctrl-]" (control close-square-bracket) or (3) "g]" (g close-square-bracket) keystroke sequence, a different issue than CVE-2008-2712.

Affected (19)

Products: Vim: Vim

Vim

1 product

Vim

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Vim Vim	Up to 7.2
Vim Vim	Version 3.0
Vim Vim	Version 4.0
Vim Vim	Version 5.0
Vim Vim	Version 5.1
Vim Vim	Version 5.2
Vim Vim	Version 5.3
Vim Vim	Version 5.4
Vim Vim	Version 5.5
Vim Vim	Version 5.6
Vim Vim	Version 5.7
Vim Vim	Version 5.8
Vim Vim	Version 6.0
Vim Vim	Version 6.1
Vim Vim	Version 6.2
Vim Vim	Version 6.3
Vim Vim	Version 6.4
Vim Vim	Version 7.0
Vim Vim	Version 7.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (78)

http://ftp.vim.org/pub/vim/patches/7.2/7.2.010

Source: cve@mitre.org

Exploit

http://groups.google.com/group/vim_dev/attach/9290f26f9bc11b33/K-arbitrary-command-execution.patch.v3?part=2

Source: cve@mitre.org

http://groups.google.com/group/vim_dev/attach/dd32ad3a84f36bb2/K-arbitrary-command-execution.patch?part=2

Source: cve@mitre.org

Patch

http://groups.google.com/group/vim_dev/browse_thread/thread/1434d0812b5c817e/6ad2d5b50a96668e

Source: cve@mitre.org

Exploit

http://groups.google.com/group/vim_dev/msg/9290f26f9bc11b33

Source: cve@mitre.org

Patch

http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: cve@mitre.org

http://secunia.com/advisories/31592

Source: cve@mitre.org

http://secunia.com/advisories/32222

Source: cve@mitre.org

http://secunia.com/advisories/32858

Source: cve@mitre.org

http://secunia.com/advisories/32864

Source: cve@mitre.org

http://secunia.com/advisories/33410

Source: cve@mitre.org

http://support.apple.com/kb/HT3216

Source: cve@mitre.org

http://support.apple.com/kb/HT4077

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2008-457.htm

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2009-001.htm

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2008:236

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/09/11/3

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/09/11/4

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/09/16/5

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2008/09/16/6

Source: cve@mitre.org

http://www.rdancer.org/vulnerablevim-K.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0580.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0617.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0618.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/495662

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/495703

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/502322/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/30795

Source: cve@mitre.org

http://www.securityfocus.com/bid/31681

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-712-1

Source: cve@mitre.org

http://www.vmware.com/security/advisories/VMSA-2009-0004.html

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/2780

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/0033

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2009/0904

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=461927

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/44626

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10894

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5812

Source: cve@mitre.org

http://ftp.vim.org/pub/vim/patches/7.2/7.2.010