Executive Summary
Informations | |||
---|---|---|---|
Name | CVE-2008-6235 | First vendor Publication | 2009-02-21 |
Vendor | Cve | Last vendor Modification | 2017-09-29 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases. |
Original Source
Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6235 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-78 | Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25) |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:11247 | |||
Oval ID: | oval:org.mitre.oval:def:11247 | ||
Title: | The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases. | ||
Description: | The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2008-6235 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22692 | |||
Oval ID: | oval:org.mitre.oval:def:22692 | ||
Title: | ELSA-2008:0580: vim security update (Moderate) | ||
Description: | The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2008:0580-01 CVE-2007-2953 CVE-2008-2712 CVE-2008-3074 CVE-2008-3075 CVE-2008-4101 CVE-2008-6235 | Version: | 29 |
Platform(s): | Oracle Linux 5 | Product(s): | vim |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:29232 | |||
Oval ID: | oval:org.mitre.oval:def:29232 | ||
Title: | RHSA-2008:0580 -- vim security update (Moderate) | ||
Description: | Updated vim packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2008:0580 CESA-2008:0580-CentOS 5 CVE-2007-2953 CVE-2008-2712 CVE-2008-3074 CVE-2008-3075 CVE-2008-4101 CVE-2008-6235 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | vim |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 2 |
OpenVAS Exploits
Date | Description |
---|---|
2009-03-31 | Name : SuSE Security Summary SUSE-SR:2009:007 File : nvt/suse_sr_2009_007.nasl |
2009-03-06 | Name : RedHat Update for vim RHSA-2008:0580-01 File : nvt/gb_RHSA-2008_0580-01_vim.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
52164 | Vim Netrw Plugin (netrw.vim) Filename Metacharacter Arbitrary Command Execution |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0580.nasl - Type : ACT_GATHER_INFO |
2010-01-06 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0580.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_gvim-090225.nasl - Type : ACT_GATHER_INFO |
2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_gvim-090225.nasl - Type : ACT_GATHER_INFO |
2009-03-13 | Name : The remote openSUSE host is missing a security update. File : suse_gvim-6023.nasl - Type : ACT_GATHER_INFO |
2008-11-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0580.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
Date | Informations |
---|---|
2021-05-04 12:08:44 |
|
2021-04-22 01:09:05 |
|
2020-05-23 00:22:55 |
|
2017-09-29 09:23:55 |
|
2016-04-26 18:17:30 |
|
2014-02-17 10:47:56 |
|
2013-05-11 00:35:28 |
|