Code Execution Flaw in Vim and Neovim

guest · Jun 11, 2019

Your Linux Can Get Hacked Just by Opening a File in Vim or Neovim Editor
June 10, 2019
https://thehackernews.com/2019/06/linux-vim-vulnerability.html

Since Neovim is just an extended forked version of Vim, with better user experience, plugins and GUIs, the code execution vulnerability also resides in it.
Code Execution Flaw in Vim and Neovim
Razmjou discovered a flaw (CVE-2019-12735) in the way Vim editor handles "modelines," a feature that's enabled-by-default to automatically find and apply a set of custom preferences mentioned by the creator of a file near the starting and ending lines in the document.

Though the editor only allows a subset of options in modelines (for security reasons) and uses sandbox protection if it contains an unsafe expression, Razmjou revealed that using ":source!" command (with a bang [!] modifier) can be used to bypass the sandbox.
Therefore, just opening an innocent looking specially crafted file using Vim or Neovim could allow attackers to secretly execute commands on your Linux system and take remote control over it.
Click to expand...

fblais · Jun 11, 2019

Wow!
I guess this was a debug feature for the sandbox, and they forgot to disable it afterwards.
But just a guess of course.

Log in or Sign up

Code Execution Flaw in Vim and Neovim

guest Guest

fblais Registered Member

Log in or Sign up

Code Execution Flaw in Vim and Neovim

guest Guest

fblais Registered Member

Useful Searches