NVD

Id
2962  
Name
CVE-2008-3074  
Description
The shellescape function in Vim 7.0 through 7.2, including 7.2a.10, allows user-assisted attackers to execute arbitrary code via the "!" (exclamation point) shell metacharacter in (1) the filename of a tar archive and possibly (2) the filename of the first file in a tar archive, which is not properly handled by the VIM TAR plugin (tar.vim) v.10 through v.22, as demonstrated by the shellescape, tarplugin.v2, tarplugin, and tarplugin.updated test cases. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2008-2712. NOTE: this issue has the same root cause as CVE-2008-3075. NOTE: due to the complexity of the associated disclosures and the incomplete information related to them, there may be inaccuracies in this CVE description and in external mappings to this identifier.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2009-02-21  
Modified Date
2010-08-21  
Seq
2008-3074  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
18628 2962 CVE-2008-3074 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506919  View
18629 2962 CVE-2008-3074 SUSE-SR:2009:007  View
18630 2962 CVE-2008-3074 20080701 Re: Collection of Vulnerabilities in Fully Patched Vim 7.1  View
18631 2962 CVE-2008-3074 oval:org.mitre.oval:def:10754  View
18632 2962 CVE-2008-3074 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0324  View
18633 2962 CVE-2008-3074 MDVSA-2008:236  View
18634 2962 CVE-2008-3074 [oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18635 2962 CVE-2008-3074 [oss-security] 20080707 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18636 2962 CVE-2008-3074 [oss-security] 20080708 Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18637 2962 CVE-2008-3074 [oss-security] 20080710 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18638 2962 CVE-2008-3074 [oss-security] 20080713 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18639 2962 CVE-2008-3074 [oss-security] 20080715 Re: Re: More arbitrary code executions in Netrw  View
18640 2962 CVE-2008-3074 [oss-security] 20080731 Re: Re: More arbitrary code executions in Netrw version 125, Vim 7.2a.10  View
18641 2962 CVE-2008-3074 [oss-security] 20081015 Vim CVE issues cleanup (plugins tar.vim, zip.vim) - CVE-2008-3074 and CVE-2008-3075  View
18642 2962 CVE-2008-3074 [oss-security] 20081020 CVE request (vim)  View
18643 2962 CVE-2008-3074 http://www.rdancer.org/vulnerablevim-shellescape.html  View
18644 2962 CVE-2008-3074 http://www.rdancer.org/vulnerablevim.html  View
18645 2962 CVE-2008-3074 RHSA-2008:0580  View
18646 2962 CVE-2008-3074 32462  View
18647 2962 CVE-2008-3074 https://bugzilla.redhat.com/show_bug.cgi?id=467428  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40099 JVNDB-2009-001105 Vim の shellescape 関数における tar アーカイブファイル名に関する任意のコードを実行される脆弱性 Vim の shellescape 関数には、tar アーカイブファイル名に関してシェルメタキャラクター "!" の処理に不備があるため、任意のコードを実行される脆弱性が存在します。 CVE-2008-3074 33187 CVE-2008-3074 2962 9.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001105.html 2009-02-21 2009-03-30 View