Vim 'PySys_SetArgv' Remote Command Execution Vulnerability

Bugtraq ID:	33447
Class:	Design Error
CVE:	CVE-2009-0316
Remote:	Yes
Local:	No
Published:	Jan 26 2009 12:00AM
Updated:	Mar 29 2010 07:52PM
Credit:	James Vega
Vulnerable:	VIM Development Group VIM 7.2.10 VIM Development Group VIM 7.1.314 VIM Development Group VIM 7.1.300 VIM Development Group VIM 7.1.299 VIM Development Group VIM 7.1.298 VIM Development Group VIM 7.2c.002 VIM Development Group VIM 7.2a.13 VIM Development Group VIM 7.2a.10 VIM Development Group VIM 7.2 VIM Development Group VIM 7.1 VIM Development Group VIM 7.0 + Mandriva Linux Mandrake 2007.1 x86_64 + Mandriva Linux Mandrake 2007.1 + Mandriva Linux Mandrake 2007.1 + Mandriva Linux Mandrake 2007.0 x86_64 + Mandriva Linux Mandrake 2007.0 x86_64 + Mandriva Linux Mandrake 2007.0 + Mandriva Linux Mandrake 2007.0 + Ubuntu Ubuntu Linux 7.04 sparc + Ubuntu Ubuntu Linux 7.04 powerpc + Ubuntu Ubuntu Linux 7.04 i386 + Ubuntu Ubuntu Linux 7.04 amd64 + Ubuntu Ubuntu Linux 6.10 sparc + Ubuntu Ubuntu Linux 6.10 powerpc + Ubuntu Ubuntu Linux 6.10 i386 + Ubuntu Ubuntu Linux 6.10 amd64 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux 5 Server Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Apple Mac OS X Server 10.5.8 Apple Mac OS X 10.5.8
Not Vulnerable:	VIM Development Group VIM 7.2.45

Vim 'PySys_SetArgv' Remote Command Execution Vulnerability

Vim is prone to a remote command-execution vulnerability.

An attacker could exploit this issue by enticing an unsuspecting victim to execute the vulnerable application in a directory containing a malicious Python file. A successful exploit will allow arbitrary Python commands to run with the privileges of the currently logged-in user.

Versions prior to Vim 7.2.045 are vulnerable.

Vim 'PySys_SetArgv' Remote Command Execution Vulnerability

An attacker may exploit this issue using commonly available tools.

Vim 'PySys_SetArgv' Remote Command Execution Vulnerability

Solution:
A vendor patch is available; please see the references for more information.


Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva vim-common-7.2.065-9.4mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-9.4mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-9.4mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-9.4mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.1

• Mandriva vim-common-7.2.065-9.4mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-9.4mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-9.4mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-9.4mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva vim-common-7.2.065-9.4mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-9.4mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-9.4mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-9.4mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

• Mandriva vim-common-7.2.065-9.4mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-9.4mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-9.4mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-9.4mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0

• Mandriva vim-common-7.2.065-9.4mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-9.4mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-9.4mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-9.4mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0

• Mandriva vim-common-7.2.065-8.4.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-8.4.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-8.4.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-8.4.20060mlcs4.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva vim-common-7.2.065-9.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-9.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-9.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-9.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva vim-common-7.2.065-9.4.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-9.4.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-9.4.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-9.4.C30mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

• Mandriva vim-common-7.2.065-9.4.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-9.4.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-9.4.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-9.4.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva vim-common-7.2.065-8.4.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-enhanced-7.2.065-8.4.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-minimal-7.2.065-8.4.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva vim-X11-7.2.065-8.4.20060mlcs4.x86_64.rpm
  http://www.mandriva.com/en/download/

Vim 'PySys_SetArgv' Remote Command Execution Vulnerability

References:

• bicyclerepair: bike.vim imports untrusted python files from cwd (Thomas Arendsen Hein)
  
• Bug 481565 - vim: untrusted python modules search path (Jan Lieskovsky)
  
• Patch 7.2.045 (Bram Moolenaar)
  
• VIM Homepage (VIM Development Group)