Vulnerability Details : CVE-2008-6235

The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell metacharacters in a filename used by the (1) "D" (delete) command or (2) b:netrw_curdir variable, as demonstrated using the netrw.v4 and netrw.v5 test cases.
Publish Date : 2009-02-21 Last Update Date : 2017-09-29

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	9.3
Confidentiality Impact	Complete (There is total information disclosure, resulting in all system files being revealed.)
Integrity Impact	Complete (There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the entire system being compromised.)
Availability Impact	Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.)
Access Complexity	Medium (The access conditions are somewhat specialized. Some preconditions must be satistified to exploit)
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)	Execute Code
CWE ID	78

- Additional Vendor Supplied Data

Vendor	Impact	CVSS Score	CVSS Vector	Report Date	Publish Date
Redhat	moderate			2008-07-15	2008-07-15

If you are a vendor and you have additional data which can be automatically imported into our database, please contact admin @ cvedetails.com

- Related OVAL Definitions

Title	Definition Id	Family
CVE-2008-6235	oval:org.opensuse.security:def:20086235	unix
ELSA-2008:0580: vim security update (Moderate)	oval:org.mitre.oval:def:22692	unix
RHSA-2008:0580 -- vim security update (Moderate)	oval:org.mitre.oval:def:29232	unix
RHSA-2008:0580: vim security update (Moderate)	oval:com.redhat.rhsa:def:20080580	unix
The Netrw plugin (netrw.vim) in Vim 7.0 and 7.1 allows user-assisted attackers to execute arbitrary commands via shell m...	oval:org.mitre.oval:def:11247	unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2008-6235

#	Product Type	Vendor	Product	Version	Update	Edition	Language
1	Application	VIM	VIM	7.0	*	*	*	Version Details Vulnerabilities
2	Application	VIM	VIM	7.1	*	*	*	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
VIM	VIM	2

- References For CVE-2008-6235

http://www.rdancer.org/vulnerablevim-netrw.v5.html

http://www.openwall.com/lists/oss-security/2008/10/16/2
MLIST [oss-security] 20081016 CVE request - Vim netrw.plugin

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
SUSE SUSE-SR:2009:007

http://secunia.com/advisories/34418
SECUNIA 34418

http://www.rdancer.org/vulnerablevim-netrw.v2.html

http://www.openwall.com/lists/oss-security/2008/10/20/2
MLIST [oss-security] 20081020 CVE request (vim)

http://www.rdancer.org/vulnerablevim-netrw.html

http://www.redhat.com/support/errata/RHSA-2008-0580.html
REDHAT RHSA-2008:0580

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11247
OVAL oval:org.mitre.oval:def:11247

- Metasploit Modules Related To CVE-2008-6235

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)