The sandbox for vim allows dangerous functions such as (1) writefile, (2) feedkeys, and (3) system, which might allow user-assisted attackers to execute shell commands and write files via modelines.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2007-0346 advisory.

    [7.0.109-3.3]
     - use gzip -9n to avoid multilib fileconflicts

     [7.0.109-3.2]
     - Let 'modeline' default to off for root
     - Resolves: bz#238259

     [7.0.109-3.1]
     - fix modeline issues
     - Resolves: bz#238259

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Tomas Golembiovsky discovered that some vim commands were accidentally allowed in modelines. By tricking a user into opening a specially crafted file in vim, an attacker could execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Files with VIM modelines could call some unsafe VIM functions (CVE-2007-2438). Modelines are disabled in the default config (/etc/vimrc) of openSUSE though.

Several vulnerabilities have been discovered in the vim editor. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-2953     Ulf Harnhammar discovered that a format string flaw in     helptags_one() from src/ex_cmds.c (triggered through the     'helptags' command) can lead to the execution of     arbitrary code.

  - CVE-2007-2438     Editors often provide a way to embed editor     configuration commands (aka modelines) which are     executed once a file is opened. Harmful commands are     filtered by a sandbox mechanism. It was discovered that     function calls to writefile(), feedkeys() and system()     were not filtered, allowing shell command execution with     a carefully crafted file opened in vim.

This updated advisory repairs issues with missing files in the packages for the oldstable distribution (sarge) for the alpha, mips, and mipsel architectures.

Updated vim packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

VIM (VIsual editor iMproved) is a version of the vi editor.

An arbitrary command execution flaw was found in the way VIM processes modelines. If a user with modelines enabled opened a text file containing a carefully crafted modeline, arbitrary commands could be executed as the user running VIM. (CVE-2007-2438)

Users of VIM are advised to upgrade to these updated packages, which resolve this issue.

Please note: this issue did not affect VIM as distributed with Red Hat Enterprise Linux 2.1, 3, or 4.

A vulnerability in vim 7.0's modeline processing capabilities was discovered where a user with modelines enabled could open a text file containing a carefully crafted modeline, executing arbitrary commands as the user running vim.

Updated packages have been patched to prevent this issue.

ID	Name	Product	Family	Severity
67494	Oracle Linux 5 : Moderate: / vim (ELSA-2007-0346)	Nessus	Oracle Linux Local Security Checks	critical
28063	Ubuntu 6.10 / 7.04 : vim vulnerability (USN-463-1)	Nessus	Ubuntu Local Security Checks	high
27474	openSUSE 10 Security Update : vim (vim-3410)	Nessus	SuSE Local Security Checks	high
25964	Debian DSA-1364-2 : vim - several vulnerabilities	Nessus	Debian Local Security Checks	high
25332	RHEL 5 : vim (RHSA-2007:0346)	Nessus	Red Hat Local Security Checks	high
25205	CentOS 5 : vim (CESA-2007:0346)	Nessus	CentOS Local Security Checks	high
25191	Mandrake Linux Security Advisory : vim (MDKSA-2007:101)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2007-2438

critical

Tenable Plugins

critical

high

high

high

high

high

high