Svaghed i Vim og Neovim redaktører fører til afvikling af kode, mens du åbner en skadelig fil

I teksteditorer Vim og Neovim blev fundet en sårbarhed (CVE-2019-12.735), som gør det muligt at udføre vilkårlig kode, mens du åbner et specielt designet fil.

The problem manifests itself with the activity of the modeline enabled by default (“: Mønstret sæt“), som gør det muligt at definere redigeringsmuligheder i filen, der behandles. Vulnerability eliminated in Vim 8.1.1365 og Neovim 0.3.6 udgivelser.

gennem modeline, allowed only a limited number of options. If expression is specified as an option value, it is executed in the sandbox mode, which allows using only the simplest safe operations.

På samme tid, Det “: Kildecommand is and in it can be used!Modifier to run arbitrary commands from specified file. Dermed, to execute the code, it is sufficient to indicate in the modeline line a construction of the formset foldexpr = execute (‘\: Kilde! Some_file’):“. In Neovim, execute call is forbidden, Men assert_fails can be used instead.

For eksempel, to executeuname -acommand, simply open a file in Vim or Neovim, the first or last line of which says:

:!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt="

Det “Kilde!%comand will read commands from the current file and, derfor, execute:! Uname -a“. To hide this line from output by the cat utility, can be used escape sequences.

For eksempel, I this prototype of an exploit during operation of a file in vim, created network connection with shell access to victim’s system, but this file will not cause suspicion when outputting to the terminal with the cat utility.

You can check the modeline activity using the: Mønstret sæt?Command. To disable vimrc, you can add the lineset nomodeline“. In distributions, the problem is fixed in RHEL, SUSE/openSUSE, Fedora, FreeBSD, Ubuntu, Arch Linux og ALT. Vulnerability remains uncorrected in Debian.

Kilde: https://nvd.nist.gov

Om Trojan Killer

Carry Trojan Killer Portable på din memory stick. Vær sikker på, at du er i stand til at hjælpe din pc modstå eventuelle cyber trusler, hvor du går.

Tjek også

MageCart på Heroku Cloud Platform

Forskere har fundet flere MageCart Web Forplove On Heroku Cloud Platform

Forskere ved Malwarebytes rapporteret om at finde flere MageCart web skummere på Heroku cloud-platform …

Android Spyware CallerSpy

CallerSpy spyware masker som en Android chat applikation

Trend Micro eksperter opdagede malware CallerSpy, hvilke masker som en Android chat program og, …

Efterlad et Svar