DESCRIPTION
Vim is a highly configurable text editor. It is an improved version
of the vi editor distributed with most UNIX systems.
Georgi Guninski found[1] a vulnerability[2] in vim that can be
exploited to execute arbitrary commands when the user opens a text
file specially crafted by an attacker. The vulnerability resides in
the "modelines" feature, which allows one to place some VIM commands
inside of a text file.
This update includes a new version of vim (6.1+patches) which,
besides the fix for the aforementioned vulnerability, contains
several other bug fixes. The vim package distributed with Conectiva
Linux 9 (vim-*-6.1-27650cl) is already patched and therefore not
vulnerable to this issue.
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- ------------------------------------------------------------------------
-
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- ------------------------------------------------------------------------
-
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- ------------------------------------------------------------------------
-
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com
Hash: SHA1
- ------------------------------------------------------------------------
--
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- ------------------------------------------------------------------------
--
PACKAGE : vim
SUMMARY : Arbitrary commands execution through modelines
DATE : 2004-02-10 17:47:00
ID : CLA-2004:812
RELEVANT
RELEASES : 8
- ------------------------------------------------------------------------
-
DESCRIPTION
Vim is a highly configurable text editor. It is an improved version
of the vi editor distributed with most UNIX systems.
Georgi Guninski found[1] a vulnerability[2] in vim that can be
exploited to execute arbitrary commands when the user opens a text
file specially crafted by an attacker. The vulnerability resides in
the "modelines" feature, which allows one to place some VIM commands
inside of a text file.
This update includes a new version of vim (6.1+patches) which,
besides the fix for the aforementioned vulnerability, contains
several other bug fixes. The vim package distributed with Conectiva
Linux 9 (vim-*-6.1-27650cl) is already patched and therefore not
vulnerable to this issue.
SOLUTION
All users should upgrade.
REFERENCES
1.http://www.guninski.com/vim1.html
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1377
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/RPMS/vim-common-6.1-1U80_1cl.i386.
rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/vim-enhanced-6.1-1U80_1cl.i38
6.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/vim-help-6.1-1U80_1cl.i386.rp
m
ftp://atualizacoes.conectiva.com.br/8/RPMS/vim-minimal-6.1-1U80_1cl.i386
.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/vim-syntax-6.1-1U80_1cl.i386.
rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/vim-X11-6.1-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/vim-6.1-1U80_1cl.src.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- ------------------------------------------------------------------------
-
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- ------------------------------------------------------------------------
-
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- ------------------------------------------------------------------------
-
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com
- ------------------------------------------------------------------------
-
subscribe: conectiva-updates-subscribe (at) papaleguas.conectiva.com (dot) br [email concealed]
unsubscribe: conectiva-updates-unsubscribe (at) papaleguas.conectiva.com (dot) br [email concealed]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFAKTVz42jd0JmAcZARArKVAKDGA9d4dgFSRNzXD8xdiPStgYpewACg4cmn
xTncF1D8KRIqtqvj2sS3fGk=
=gOO7
-----END PGP SIGNATURE-----
[ reply ]