vulnwire
9.3crit

CVE-2008-3074

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (e…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
9.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.8%
percentile 90%
Public exploits
0
none known

The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.

Exploit prediction (EPSS)

3.84% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • lists.opensuse.org /opensuse-security-announce/2009-03/msg00004.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • rdancer.org /vulnerablevim.html · x_refsource_MISC, x_transferred
  • openwall.com /lists/oss-security/2008/07/15/4 · mailing-list, x_refsource_MLIST, x_transferred
  • openwall.com /lists/oss-security/2008/10/20/2 · mailing-list, x_refsource_MLIST, x_transferred
  • securityfocus.com /bid/32462 · vdb-entry, x_refsource_BID, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10754 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • openwall.com /lists/oss-security/2008/07/13/1 · mailing-list, x_refsource_MLIST, x_transferred
  • redhat.com /support/errata/RHSA-2008-0580.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • secunia.com /advisories/34418 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • openwall.com /lists/oss-security/2008/07/07/1 · mailing-list, x_refsource_MLIST, x_transferred
  • openwall.com /lists/oss-security/2008/08/01/1 · mailing-list, x_refsource_MLIST, x_transferred
  • wiki.rpath.com /wiki/Advisories:rPSA-2008-0324 · x_refsource_CONFIRM, x_transferred
  • marc.info /?l=bugtraq&m=121494431426308&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • openwall.com /lists/oss-security/2008/07/08/12 · mailing-list, x_refsource_MLIST, x_transferred
  • bugs.debian.org /cgi-bin/bugreport.cgi?bug=506919 · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2008/07/10/7 · mailing-list, x_refsource_MLIST, x_transferred
  • openwall.com /lists/oss-security/2008/07/07/4 · mailing-list, x_refsource_MLIST, x_transferred
  • rdancer.org /vulnerablevim-shellescape.html · x_refsource_MISC, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:236 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=467428 · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2008/10/15/1 · mailing-list, x_refsource_MLIST, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.