oss-sec mailing list archives
Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10
From: Tomas Hoger <thoger () redhat com>
Date: Thu, 10 Jul 2008 18:55:46 +0200
Hi Jonathan! On Tue, 8 Jul 2008 13:53:48 -0400 (EDT) "Steven M. Christey" <coley () linus mitre org> wrote:
On Mon, 7 Jul 2008, Jonathan Smith wrote:Steve, could we get CVEs assigned, please? I'd imagine we'd need three; one for the tarplugin issue, one for the zipplugin, and one for the netrw issues (which are similar enough to probably justify lumping them together).CVE-2008-3074 - tarplugin CVE-2008-3075 - zipplugin CVE-2008-3076 - netrw issues These will be filled in later.
Are you sure 3 new CVEs are needed for this second rdancer advisory? Advisory text itself only speaks of netrw issues and it's not quite obvious to me why zip and tar tests are included in the test suite. Maybe just to point out that those issues are still unfixed. Moreover, if you diff zipplugin directories in vulnerablevim.tar.bz2 and vulnerablevim-netrw.tar.bz2, you will see this test did not change at all between the two test suites. So CVE-2008-3075 should already be covered by previous CVE-2008-2712. tarplugin test was updated since the first test suite to use different payload. I'm not really sure if it is the same issue or not, but the new exploit is blocked by the previously proposed Jan's patch. So it may be the same issue as described in the first advisory. Btw, CVE-2008-2712 description does not mention tar.vim issue. It is described in 3.4.2.3, but its test does not seem to be run when doing make test for the top-most Makefile in the first test suite. Jonathan, did new netrw tests work for you? With which vim version? They all failed for me with vim 7.1.245 / netrw 109. Adding also Jan to CC, in case he is interested in tossing in some comments. For some context for discussion, you can see: http://marc.info/?t=121541947300001&r=1&w=4 Jan, feel free to ignore this discussion if you are not interested, though your comments are welcome. Thanks! -- Tomas Hoger
Current thread:
- Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Jonathan Smith (Jul 07)
- Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Steven M. Christey (Jul 08)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Tomas Hoger (Jul 10)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Jan Minář (Jul 12)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Tomas Hoger (Jul 15)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Jan Minář (Jul 16)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Tomas Hoger (Jul 16)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Jan Minář (Jul 16)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Tomas Hoger (Jul 10)
- Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Steven M. Christey (Jul 08)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Jonathan Smith (Jul 20)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Tomas Hoger (Jul 20)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Steven M. Christey (Jul 31)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Tomas Hoger (Aug 05)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 Jan Minář (Jul 21)