#VU31049 OS Command Injection in Vim - CVE-2019-12735
Vulnerability identifier: #VU31049
Vulnerability risk: Low
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2019-12735
CWE-ID:
CWE-78
Exploitation vector: Local
Exploit availability: Yes
Vulnerable software:
Vim
Client/Desktop applications /
Software for system administration
Vendor: Vim.org
Description
The vulnerability allows a local non-authenticated attacker to execute arbitrary code.
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Vim: 8.1.0000 - 8.1.1364
External links
https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html
https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html
https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html
https://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html
https://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html
https://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html
https://www.securityfocus.com/bid/108724
https://access.redhat.com/errata/RHSA-2019:1619
https://access.redhat.com/errata/RHSA-2019:1774
https://access.redhat.com/errata/RHSA-2019:1793
https://access.redhat.com/errata/RHSA-2019:1947
https://bugs.debian.org/930020
https://bugs.debian.org/930024
https://github.com/neovim/neovim/pull/10082
https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md
https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040
https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/
https://seclists.org/bugtraq/2019/Jul/39
https://seclists.org/bugtraq/2019/Jun/33
https://security.gentoo.org/glsa/202003-04
https://support.f5.com/csp/article/K93144355
https://support.f5.com/csp/article/K93144355?utm_source=f5support&utm_medium=RSS
https://usn.ubuntu.com/4016-1/
https://usn.ubuntu.com/4016-2/
https://www.debian.org/security/2019/dsa-4467
https://www.debian.org/security/2019/dsa-4487
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
