Ubuntu
vim package

Collection of vulnerabilities in Vim reported by rdancer

Bug #240216 reported by Olivier Mengué
258
Affects Status Importance Assigned to Milestone
vim (Gentoo Linux)
Fix Released
High
vim (Ubuntu)
Fix Released
Undecided
Unassigned
Dapper
Fix Released
Undecided
Jamie Strandboge
Feisty
Won't Fix
Undecided
Jamie Strandboge
Gutsy
Fix Released
Undecided
Jamie Strandboge
Hardy
Fix Released
Undecided
Jamie Strandboge

Bug Description

Binary package hint: vim

Multiples vulnerabilities exploitable from file content or file names have been reported here:
http://www.rdancer.org/vulnerablevim.html

Current version of Vim in Hardy is 7.1.138 which is older than the reported vulnerable version, so is vulnerable too.

Upgrade to Vim 7.1.314 or above is recommended.
See http://groups.google.com/group/vim_dev/browse_thread/thread/0a5543c9cee7c274

Related branches

lp:ubuntu/karmic/vim
Revision history for this message
In , GNUtoo (gnutoo) wrote :

Vim Shell Command Injection Vulnerabilities see the url

Reproducible: Always

Revision history for this message
In , Ali Polatel (hawking) wrote :

I've bumped vim-core,vim and gvim to 7.1.319.
@security: I plan to remove vim-6.4. Do you want me to mask it or will you do it?

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (3.3 KiB)

This bug was fixed in the package vim - 1:7.1.314-3ubuntu1

---------------
vim (1:7.1.314-3ubuntu1) intrepid; urgency=low

  * Resynchronise with Debian. Remaining changes:
    - Enable detection of GNU screen as a mouse-capable terminal.
    - Add NoDisplay=true to gvim.desktop.
    - Drop vim-lesstif package and lesstif2-dev build-dependency.
    - Build-depend on libxt-dev.
    - Enable Python interpreter on basic builds.
    - Create a .pot file for translations.
    - Disable autoindent, line-wrapping, and backup files by default.
  * Fixes various vulnerabilities due to improper quoting of 'execute'
    arguments (LP: #240216).
  * Drop fixes for upgrade problems from Ubuntu 6.06 LTS; direct upgrades
    from 6.06 to 8.10 will not be supported.

vim (1:7.1.314-3) unstable; urgency=high

  * Update runtime files affected by the filename escape vulnerability.
    (CVE 2008-2712, Closes: #486502)
  * debian/vim-runtime.preinst:
    - Only add the diversions if the preinst is called with the "install" or
      "upgrade" (to handle the previous mishandling in postrm) arguments.
  * debian/vim-runtime.postrm:
    - Only remove the diversions if the postrm is called with the "remove"
      argument. (Closes: #486446)
  * runtime/menu.vim:
    - Escape the buffer name when using the "Window -> Split File Explorer"
      menu item. (Closes: #486417)

vim (1:7.1.314-2) unstable; urgency=low

  * debian/rules:
    - Tell configure to only check the GUI toolkit specific to the variant
      being built. (Closes: #486319, #486336)
  * runtime/ftplugin/debchangelog.vim:
    - Merge Launchpad bug completion from Ubuntu.
    - Specify the full path when calling apt-listbugs instead of relying on
      /usr/sbin being in the user's path.
    - Improve error handling for Launchpad bug completion.

vim (1:7.1.314-1) unstable; urgency=low

  * New upstream patches (294 - 314), see README.gz for details.
    - SELinux support merged upstream
  * Update NetRW to version 125n (pre-release).
    - Calculate length of multi-byte strings properly. (Closes: #474609)
    - Display/navigate symlinks to directories properly. (Closes: #474980)
  * Update vim-git runtime files.
  * debian/update-patches:
    - Fix determination of patch level from last commit.
    - Use debian:debian/README to determine current patch level.
    - Don't exit on error since that prevents correcting merges.
    - Use a standard commit message for debian/README.
  * runtime/ftplugin/debchangelog.vim:
    - NewVersion() should only call foldopen if folding is enabled.
  * runtime/macros/justify.vim:
    - Calculate strlen for multi-byte strings properly. (Closes: #481115)
  * debian/rules:
    - Make use of upstream's "shadow" directories so the variants can be built
      in parallel.
    - Remove .NOTPARALLEL to allow parallel building.
    - Remove useless dh_shlibdeps call in the binary-indep target.
    - Remove autoconf-stamp target since we're no longer patching configure.
  * debian/vim-runtime.install:
    - Add new gvimtutor to vim-runtime package.
  * Very carefully divert vim-tiny's help.txt and helptags so they will still
    be in place if vim-runtime is removed.
  * d...

Read more...

Changed in vim:
status: New → Fix Released
Jamie Strandboge (jdstrand)
Changed in vim:
assignee: nobody → jdstrand
status: New → Confirmed
assignee: nobody → jdstrand
status: New → Confirmed
assignee: nobody → jdstrand
status: New → Confirmed
assignee: nobody → jdstrand
status: New → Confirmed
Revision history for this message
In , Py (py) wrote :

ali: please proceed with the mask.
Arches, please test and mark stable app-editors/vim-core-7.1.319. Target KEYWORDS: "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc ~sparc-fbsd x86 ~x86-fbsd"

Revision history for this message
In , Bluebird (bluebird) wrote :

Are we supposted to just stablize vim-core or vim-core,vim and gvim?

Revision history for this message
In , Py (py) wrote :

(In reply to comment #3)
> Are we supposted to just stablize vim-core or vim-core,vim and gvim?
>

both of them, my mistake.

Revision history for this message
In , Jeroen Roovers (jer-gentoo) wrote :

(In reply to comment #4)
> (In reply to comment #3)
> > Are we supposted to just stablize vim-core or vim-core,vim and gvim?
> >
>
> both of them, my mistake.

All three of them.

Revision history for this message
In , Cla-o (cla-o) wrote :

amd64/x86 stable

Revision history for this message
In , Cla-o (cla-o) wrote :

Also unCC arches.

Revision history for this message
In , Jeroen Roovers (jer-gentoo) wrote :

Stable for HPPA.

Revision history for this message
In , Fmccor (fmccor) wrote :

All three stable on sparc. I've been using [vim, gvim]-7.1.319 pretty heavily for almost four weeks with no problems.

Revision history for this message
In , Ranger-z (ranger-z) wrote :

ppc and ppc64 done for all three pkgs

Revision history for this message
In , Raúl Porcel (armin76) wrote :

alpha/ia64 stable

Revision history for this message
In , Keytoaster (keytoaster) wrote :

Does this version actually fix all of the vulnerabilities? Using the test suite from http://www.rdancer.org/vulnerablevim.html I get the following result:

-------------------------------------------
-------- Test results below ---------------
-------------------------------------------
filetype.vim
  strong : EXPLOIT FAILED
  weak : EXPLOIT FAILED
zipplugin : VULNERABLE
xpm.vim
  xpm : VULNERABLE
  xpm2 : VULNERABLE
  remote : VULNERABLE
gzip_vim : EXPLOIT FAILED
netrw : VULNERABLE

Should be noted in the GLSA I guess.

Revision history for this message
In , Keytoaster (keytoaster) wrote :

vim team, do you know if upstream is trying to fix the remaining issues in the near future? if yes, we will postpone this glsa until everything is fixed.

Revision history for this message
In , Ali Polatel (hawking) wrote :

(In reply to comment #13)
> vim team, do you know if upstream is trying to fix the remaining issues in the
> near future? if yes, we will postpone this glsa until everything is fixed.
>

{vim,gvim}-7.2 fixes this. It's in CVS.
-------------------------------------------
-------- Test results below ---------------
-------------------------------------------
Vim version 7.2
zip.vim version:
netrw.vim version:
-------------------------------------------
filetype.vim
  strong : EXPLOIT FAILED
  weak : EXPLOIT FAILED
tarplugin : EXPLOIT FAILED
tarplugin.updated: EXPLOIT FAILED
tarplugin.v2: EXPLOIT FAILED
zipplugin : EXPLOIT FAILED
zipplugin.v2: EXPLOIT FAILED
xpm.vim
  xpm : EXPLOIT FAILED
  xpm2 : EXPLOIT FAILED
  remote : EXPLOIT FAILED
gzip_vim : EXPLOIT FAILED
netrw : EXPLOIT FAILED
netrw.v2 : EXPLOIT FAILED
netrw.v3 : EXPLOIT FAILED
netrw.v4 : EXPLOIT FAILED
netrw.v5 : EXPLOIT FAILED
shellescape: EXPLOIT FAILED

Revision history for this message
Olivier Mengué (dolmen) wrote :

Can we expect a backport to Hardy for this security vulnerability?

Bug Watch Updater (bug-watch-updater)
Changed in vim:
status: Unknown → In Progress
Revision history for this message
Mark Painter (mpainter) wrote :

Any update or information on when we can expect something for Hardy and Dapper?

Revision history for this message
x (xk2c-deactivatedaccount) wrote :

see also:

http://thread.gmane.org/gmane.linux.debian.devel.release/25200/focus=25640

Revision history for this message
Hew (hew) wrote :

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

Changed in vim:
status: Confirmed → Won't Fix
Revision history for this message
Mark Painter (mpainter) wrote :

Any update for this on Dapper, Gutsy, or Hardy?

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

These were all fixed in http://www.ubuntu.com/usn/USN-712-1.

Jamie Strandboge (jdstrand)
Changed in vim (Ubuntu Dapper):
status: Confirmed → Fix Released
Changed in vim (Ubuntu Gutsy):
status: Confirmed → Fix Released
Changed in vim (Ubuntu Hardy):
status: Confirmed → Fix Released
Bug Watch Updater (bug-watch-updater)
Changed in vim (Gentoo Linux):
importance: Unknown → High
Revision history for this message
Olivier Mengué (dolmen) wrote :

The bug has been fixed in Gentoo, but it looks like they forgot to publish a GLSA. Until then they will not close the bug in their bugtracker.

Revision history for this message
In , Ackle (ackle) wrote :

This issue has been fixed on Security-supported arches since Aug 15, 2008. No GLSA will be issued

Bug Watch Updater (bug-watch-updater)
Changed in vim (Gentoo Linux):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.