Vim 'mch_expand_wildcards()' Heap Based Buffer Overflow Vulnerability
BID:30648
Info
Vim 'mch_expand_wildcards()' Heap Based Buffer Overflow Vulnerability
| Bugtraq ID: | 30648 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2008-3432 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 29 2005 12:00AM |
| Updated: | Jan 08 2010 08:01PM |
| Credit: | Brian Hirt |
| Vulnerable: |
VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.2 VMWare ESX Server 2.5.5 VMWare ESX Server 3.5 VIM Development Group VIM 6.3.58 VIM Development Group VIM 6.3 VIM Development Group VIM 6.2.429 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux Desktop version 4 Redhat Desktop 3.0 Avaya Voice Portal 4.1 Avaya Voice Portal 4.0 Avaya Voice Portal 3.0 Avaya SIP Enablement Services 3.1.2 Avaya SIP Enablement Services 4.0 Avaya Proactive Contact 4.0 Avaya Proactive Contact 3.0 Avaya Proactive Contact 0 Avaya Messaging Storage Server MSS 3.0 Avaya Messaging Storage Server MM3.0 Avaya Messaging Storage Server 4.0 Avaya Messaging Storage Server 3.1 Avaya Messaging Storage Server 2.0 Avaya Messaging Storage Server 1.0 Avaya Messaging Storage Server Avaya Message Networking MN 3.1 Avaya Message Networking 3.1 Avaya Message Networking Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 Avaya Intuity AUDIX LX 2.0 Avaya Communication Manager 4.0.3 SP1 Avaya Communication Manager 3.1.4 SP2 Avaya Communication Manager 2.0.1 Avaya Communication Manager 2.0 Avaya Communication Manager 1.3.1 Avaya Communication Manager 1.1 Avaya Communication Manager 5.1 Avaya Communication Manager 5.0 SP3 Avaya Communication Manager 5.0 Avaya Communication Manager 4.0 Avaya Communication Manager 3.1 Avaya Communication Manager 3.0 Avaya Communication Manager 2.2 Avaya Communication Manager 2.1 Avaya Aura SIP Enablement Services 3.1.1 Avaya Aura SIP Enablement Services 5.0 Avaya Aura SIP Enablement Services 3.1 Avaya Aura SIP Enablement Services 3.0 Avaya Aura Application Enablement Services 4.2.1 Avaya Aura Application Enablement Services 4.0.1 Avaya Aura Application Enablement Services 3.1.5 Avaya Aura Application Enablement Services 3.1.4 Avaya Aura Application Enablement Services 3.1.3 Avaya Aura Application Enablement Services 4.1 Avaya Aura Application Enablement Services 3.0 Avaya AES 3.1.6 Avaya AES 4.2 Avaya AES 4.0 Avaya AES 3.1 |
| Not Vulnerable: |
VIM Development Group VIM 6.3.59 |
Discussion
Vim 'mch_expand_wildcards()' Heap Based Buffer Overflow Vulnerability
Vim is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
An attacker may exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will likely result in denial-of-service conditions.
This issue affects Vim 6.2.429 through 6.3.058.
Vim is prone to a heap-based buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.
An attacker may exploit this issue to execute arbitrary code with the privileges of the user running the application. Failed exploit attempts will likely result in denial-of-service conditions.
This issue affects Vim 6.2.429 through 6.3.058.
Exploit / POC
Vim 'mch_expand_wildcards()' Heap Based Buffer Overflow Vulnerability
The following exploit code is available:
The following exploit code is available:
Solution / Fix
Vim 'mch_expand_wildcards()' Heap Based Buffer Overflow Vulnerability
Solution:
This issue was addressed on January 29, 2005 in Vim 6.3.059. Please see the references for more information.
VMWare ESX Server 3.5
VMWare ESX Server 2.5.5
VMWare ESX Server 3.0.2
VMWare ESX Server 3.0.3
Solution:
This issue was addressed on January 29, 2005 in Vim 6.3.059. Please see the references for more information.
VMWare ESX Server 3.5
-
VMWare ESX350-200904406-SG.zip
http://download3.vmware.com/software/vi/ESX350-200904406-SG.zip
VMWare ESX Server 2.5.5
-
VMWare esx-2.5.5-161312-upgrade.tar.gz
http://download3.vmware.com/software/esx/esx-2.5.5-161312-upgrade.tar. gz
VMWare ESX Server 3.0.2
-
VMWare ESX-1008406.tgz
http://download3.vmware.com/software/vi/ESX-1008406.tgz
VMWare ESX Server 3.0.3
-
VMWare ESX303-200903403-SG.zip
http://download3.vmware.com/software/vi/ESX303-200903403-SG.zip
References
Vim 'mch_expand_wildcards()' Heap Based Buffer Overflow Vulnerability
References:
References:
- [Other] Bug 455455 - (CVE-2008-3432) CVE-2008-3432 vim: heap buffer overflo (Red Hat)
- Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10 (Tomas Hoger
- VIM Homepage (VIM Development Group)
- ASA-2009-001 - vim security update (RHSA-2008-0617) (Avaya)
- Revision 1.111 - Log of /vim/src/os_unix.c (Vim)