sandbox for vim allows attackers to execute shell commands and write files via modelines

Debian Bug report logs - #435401
sandbox for vim allows attackers to execute shell commands and write files via modelines

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: sandbox for vim allows attackers to execute shell commands and write files via modelines

Date: Tue, 31 Jul 2007 23:44:38 +1000

Package: vim
Version: 1:7.1-022+1
Severity: grave
Tags: security
Justification: user security hole

Hi mates

I found this CVE[0], which states:

The sandbox for vim allows dangerous functions such as (1) writefile,
(2) feedkeys, and (3) system, which might allow user-assisted attackers
to execute shell commands and write files via modelines.


I also saw that there is an ubuntu security announce, including these
two patches[1] as a fix.

Can you please investigate, if any versions in debian are vulnerable?
Please also feel free to downgrade/close this bug, if the fix is already
in unstable.
Thanks for your efforts.

Cheers
Steffen

[0]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2438

[1]: http://developer.skolelinux.no/~white/security/vim/

Message #10 received at 435401@bugs.debian.org (full text, mbox, reply):

From: "Taylor, Christopher PO2 USN (NCTS La Maddalena)" <taylorc@lamadd.navy.mil>

To: 435401@bugs.debian.org

Subject: sandbox for vim allows attackers to execute shell commands and wr ite files

Date: Mon, 6 Aug 2007 13:17:11 +0200

FrSirt states that this has been fixed as of version 7.0.235[0]. The current
version in unstable is 7.1

The version in stable is currently vulnerable. 

The version in unstable does not appear to be vulnerable, as none of the
exploits I tried against it were successful.




[0]http://www.frsirt.com/english/advisories/2007/1599

Message #15 received at 435401@bugs.debian.org (full text, mbox, reply):

From: James Vega <jamessan@jamessan.com>

To: "Taylor, Christopher PO2 USN (NCTS La Maddalena)" <taylorc@lamadd.navy.mil>, 435401@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#435401: sandbox for vim allows attackers to execute shell commands and wr ite files

Date: Mon, 6 Aug 2007 08:28:31 -0400

[Message part 1 (text/plain, inline)]

package vim
found 435401 1:7.0-122+1etch4
notfound 435401 1:7.1-022+1
thanks

On Mon, Aug 06, 2007 at 01:17:11PM +0200, Taylor, Christopher PO2 USN (NCTS La Maddalena) wrote:
> FrSirt states that this has been fixed as of version 7.0.235[0]. The current
> version in unstable is 7.1
> 
> The version in stable is currently vulnerable. 
> 
> The version in unstable does not appear to be vulnerable, as none of the
> exploits I tried against it were successful.
> 
> [0]http://www.frsirt.com/english/advisories/2007/1599

Thanks for taking a look at this.  I'll work on getting a package ready
for the stable release and contacting the security team.

James
-- 
GPG Key: 1024D/61326D40 2003-09-02 James Vega <jamessan@debian.org>

[signature.asc (application/pgp-signature, inline)]

Message #24 received at 435401@bugs.debian.org (full text, mbox, reply):

From: kurt@roeckx.be (Kurt Roeckx)

To: control@bugs.debian.org

Cc: 435401@bugs.debian.org

Subject: closing 435401

Date: Sat, 11 Aug 2007 17:56:46 +0200 (CEST)

# Automatically generated email from bts, devscripts version 2.9.6
# 7.1 shouldn't have this problem, so marking it as fixed and closing.
close 435401 1:7.1-022+1

Message #31 received at 435401@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: James Vega <jamessan@jamessan.com>

Cc: "Taylor, Christopher PO2 USN (NCTS La Maddalena)" <taylorc@lamadd.navy.mil>, 435401@bugs.debian.org, jmm@debian.org

Subject: Re: Bug#435401: sandbox for vim allows attackers to execute shell commands and wr ite files

Date: Fri, 17 Aug 2007 23:06:21 +0200

James Vega wrote:
> > FrSirt states that this has been fixed as of version 7.0.235[0]. The current
> > version in unstable is 7.1
> > 
> > The version in stable is currently vulnerable. 
> > 
> > The version in unstable does not appear to be vulnerable, as none of the
> > exploits I tried against it were successful.
> > 
> > [0]http://www.frsirt.com/english/advisories/2007/1599
> 
> Thanks for taking a look at this.  I'll work on getting a package ready
> for the stable release and contacting the security team.

What's the status? If you prepare an update for us, please include the fix
for ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039 (CVE-2007-2953).

Cheers,
        Moritz

Message #36 received at 435401@bugs.debian.org (full text, mbox, reply):

From: James Vega <jamessan@debian.org>

To: Moritz Muehlenhoff <jmm@inutil.org>

Cc: 435401@bugs.debian.org, control@bugs.debian.org

Subject: Re: Bug#435401: sandbox for vim allows attackers to execute shell commands and wr ite files

Date: Fri, 17 Aug 2007 22:44:19 -0400

[Message part 1 (text/plain, inline)]

package vim
clone 435401
retitle -1 Format string vulnerability possibly allows arbitrary code execution
tag -1 security
severity -1 grave
found -1 1:7.0-122+1etch4
thanks

On Fri, Aug 17, 2007 at 11:06:21PM +0200, Moritz Muehlenhoff wrote:
> James Vega wrote:
> > Thanks for taking a look at this.  I'll work on getting a package ready
> > for the stable release and contacting the security team.
> 
> What's the status? If you prepare an update for us, please include the fix
> for ftp://ftp.vim.org/pub/vim/patches/7.1/7.1.039 (CVE-2007-2953).

I haven't had much free time recently.  I'll get this done this weekend.
Thanks for the prod and note about the other vulnerability.  I've cloned
this bug for the new vulnerability.

James
-- 
GPG Key: 1024D/61326D40 2003-09-02 James Vega <jamessan@debian.org>

[signature.asc (application/pgp-signature, inline)]

Message #43 received at 435401-close@bugs.debian.org (full text, mbox, reply):

From: James Vega <jamessan@debian.org>

To: 435401-close@bugs.debian.org

Subject: Bug#435401: fixed in vim 1:7.0-122+1etch4

Date: Sat, 01 Sep 2007 19:56:28 +0000

Source: vim
Source-Version: 1:7.0-122+1etch4

We believe that the bug you reported is fixed in the latest version of
vim, which is due to be installed in the Debian FTP archive:

vim-common_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-common_7.0-122+1etch4_i386.deb
vim-doc_7.0-122+1etch4_all.deb
  to pool/main/v/vim/vim-doc_7.0-122+1etch4_all.deb
vim-full_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-full_7.0-122+1etch4_i386.deb
vim-gnome_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-gnome_7.0-122+1etch4_i386.deb
vim-gtk_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-gtk_7.0-122+1etch4_i386.deb
vim-gui-common_7.0-122+1etch4_all.deb
  to pool/main/v/vim/vim-gui-common_7.0-122+1etch4_all.deb
vim-lesstif_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-lesstif_7.0-122+1etch4_i386.deb
vim-perl_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-perl_7.0-122+1etch4_i386.deb
vim-python_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-python_7.0-122+1etch4_i386.deb
vim-ruby_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-ruby_7.0-122+1etch4_i386.deb
vim-runtime_7.0-122+1etch4_all.deb
  to pool/main/v/vim/vim-runtime_7.0-122+1etch4_all.deb
vim-tcl_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-tcl_7.0-122+1etch4_i386.deb
vim-tiny_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim-tiny_7.0-122+1etch4_i386.deb
vim_7.0-122+1etch4.diff.gz
  to pool/main/v/vim/vim_7.0-122+1etch4.diff.gz
vim_7.0-122+1etch4.dsc
  to pool/main/v/vim/vim_7.0-122+1etch4.dsc
vim_7.0-122+1etch4_i386.deb
  to pool/main/v/vim/vim_7.0-122+1etch4_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 435401@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
James Vega <jamessan@debian.org> (supplier of updated vim package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 17 Aug 2007 22:46:28 -0400
Source: vim
Binary: vim-full vim-lesstif vim-common vim-gnome vim-doc vim-runtime vim vim-gtk vim-perl vim-ruby vim-gui-common vim-tiny vim-python vim-tcl
Architecture: source all i386
Version: 1:7.0-122+1etch4
Distribution: stable-security
Urgency: high
Maintainer: Debian VIM Maintainers <pkg-vim-maintainers@lists.alioth.debian.org>
Changed-By: James Vega <jamessan@debian.org>
Description: 
 vim        - Vi IMproved - enhanced vi editor
 vim-common - Vi IMproved - Common files
 vim-doc    - Vi IMproved - HTML documentation
 vim-full   - Vi IMproved - enhanced vi editor - full fledged version
 vim-gnome  - Vi IMproved - enhanced vi editor - with GNOME2 GUI
 vim-gtk    - Vi IMproved - enhanced vi editor - with GTK2 GUI
 vim-gui-common - Vi IMproved - Common GUI files
 vim-lesstif - Vi IMproved - enhanced vi editor - with LessTif GUI
 vim-perl   - Vi IMproved - enhanced vi editor - with Perl support
 vim-python - Vi IMproved - enhanced vi editor - with Python support
 vim-ruby   - Vi IMproved - enhanced vi editor - with Ruby support
 vim-runtime - Vi IMproved - Runtime files
 vim-tcl    - Vi IMproved - enhanced vi editor - with TCL support
 vim-tiny   - Vi IMproved - enhanced vi editor - compact version
Closes: 435401 438593
Changes: 
 vim (1:7.0-122+1etch4) stable-security; urgency=high
 .
   * Add upstream patches 7.0.234 and 7.0.235 which fix CVE-2007-2438.
     (Closes: #435401)
   * Add upstream patch 7.1.039 which fixes CVE-2007-2953.  (Closes: #438593)
Files: 
 cbe01a52d42f25617a4e3609b91b327f 1437 editors optional vim_7.0-122+1etch4.dsc
 9ba05680b0719462f653e82720599f32 8457888 editors optional vim_7.0.orig.tar.gz
 acd1e7b91a1ec5e3417118045cd8bb2e 285021 editors optional vim_7.0-122+1etch4.diff.gz
 64ac83f818c9f9b3bbf40ca56b15b725 142582 editors optional vim-gui-common_7.0-122+1etch4_all.deb
 b27f042fadc4507f2a4829b10e6949da 6362332 editors optional vim-runtime_7.0-122+1etch4_all.deb
 c589a9ec2cd7c3c6f45f48ff58871c5a 2034356 doc optional vim-doc_7.0-122+1etch4_all.deb
 81c890f5348042c2060fea9bb8368279 540270 editors important vim-tiny_7.0-122+1etch4_i386.deb
 55929d92c3b2d496ba95cb2e80da1d69 913800 editors extra vim-ruby_7.0-122+1etch4_i386.deb
 eadd254febb55b2a69613ebc8d710774 872952 editors extra vim-tcl_7.0-122+1etch4_i386.deb
 28876441af29051e315a3c1a8b71bcca 865592 editors extra vim-gtk_7.0-122+1etch4_i386.deb
 20dcd46eb38f1b32e600dddc81b8e328 859848 editors extra vim-lesstif_7.0-122+1etch4_i386.deb
 8639573d18e103d6e816f9bacdc844ef 924264 editors extra vim-perl_7.0-122+1etch4_i386.deb
 8ecf10dd01bb07c53aab5782db738602 917972 editors extra vim-python_7.0-122+1etch4_i386.deb
 501208beae0375d1610e3cebfefcf542 868016 editors extra vim-gnome_7.0-122+1etch4_i386.deb
 41be0b2741614c054fece73548cec703 947320 editors extra vim-full_7.0-122+1etch4_i386.deb
 bdd2098b76d4885f28e1f6e3b7376b7d 181252 editors important vim-common_7.0-122+1etch4_i386.deb
 956ef68561a71a8eed0047175dfff9d5 745158 editors optional vim_7.0-122+1etch4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG1VXZXm3vHE4uyloRAkI8AKCw4fK0uMDLLQVqUvV04L9ltzP7wQCg7M2k
NFbDu5zTgeu1ok75rN3ay5Y=
=kFGu
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.