Bug 461745

Summary: vim: arbitrary command execution when handling tar archives
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED DUPLICATE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: karsten
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-09-11 14:01:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 451759    

Description Jan Lieskovsky 2008-09-10 12:18:30 UTC 
Description of problem:

A security vulnerability was discovered in the way, vim processes
the names of files, directories and tar archives. The fnameescape()
function makes the untrusted file name safe as an argument to ``execute''.
The sanitization of the provided inputs, performed by this function is not sufficient, which results into the situation,in which the code which uses the
output of the fnameescape() function is vulnerable again, i.e. the commands called by ``execute'' will in turn each interpret the untrusted file name
again. An attacker could use this flaw to execute arbitrary code when
handling tar archives.

Version-Release number of selected component (if applicable):
Vim >= 7.0 (possibly older)

How reproducible:
No reproducer

References:

    http://www.rdancer.org/vulnerablevim-tarplugin.v3.html (original report)

Proposed patch 7.2c.002

    http://groups.google.com/group/vim_dev/msg/80882b9ee9293139
    http://ftp.vim.org/pub/vim/unstable/patches/7.2c/7.2c.002
Comment 1 Jan Lieskovsky 2008-09-11 14:01:34 UTC 

*** This bug has been marked as a duplicate of bug 451759 ***