VIM before 6.3 and gVim before 6.3 allow local users to execute arbitrary commands via a file containing a crafted modeline that is executed when the file is viewed using options such as (1) termcap, (2) printdevice, (3) titleold, (4) filetype, (5) syntax, (6) backupext, (7) keymap, (8) patchmode, or (9) langmenu.

Ciaran McCreesh found several vulnerabilities related to the use of options in Vim modeline commands, such as 'termcap', 'printdevice', 'titleold', 'filetype', 'syntax', 'backupext', 'keymap', 'patchmode', and 'langmenu'.

If an attacker tricked an user to open a file with a specially crafted modeline, he could exploit this to execute arbitrary commands with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ciaran McCreesh discovered news ways in which a VIM modeline can be used to trojan a text file. The patch by Bram Moolenaar reads :

Problem: Unusual characters in an option value may cause unexpected behavior, especially for a modeline. (Ciaran McCreesh)

Solution: Don't allow setting termcap options or 'printdevice' or 'titleold' in a modeline. Don't list options for 'termcap' and 'all' in a modeline. Don't allow unusual characters in 'filetype', 'syntax', 'backupext', 'keymap', 'patchmode' and 'langmenu'.

Note: It is generally recommended that VIM users use set nomodeline in ~/.vimrc to avoid the possibility of trojaned text files.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:036 advisory.

    VIM (Vi IMproved) is an updated and improved version of the vi screen-based     editor.

    Ciaran McCreesh discovered a modeline vulnerability in VIM.  An attacker     could create a text file containing a specially crafted modeline which     could cause arbitrary command execution when viewed by a victim using VIM.
    The Common Vulnerabilities and Exposures project has assigned the name     CAN-2004-1138 to this issue.  Please note that this issue only affects     users who have modelines and filetype plugins enabled, which is not the     default.

    The Debian Security Audit Project discovered an insecure temporary file     usage in VIM.  A local user could overwrite or create files as a different     user who happens to run one of the the vulnerable utilities.  The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-0069 to this issue.

    All users of VIM are advised to upgrade to these erratum packages,     which contain backported patches for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several 'modeline'-related vulnerabilities were discovered in Vim by Ciaran McCreesh. The updated packages have been patched with Bram Moolenaar's vim 6.3.045 patch which fixes the reported vulnerabilities and adds more conservative 'modeline' rights.

Updated vim packages that fix a modeline vulnerability are now available.

VIM (Vi IMproved) is an updated and improved version of the vi screen-based editor.

Ciaran McCreesh discovered a modeline vulnerability in VIM. It is possible that a malicious user could create a file containing a specially crafted modeline which could cause arbitrary command execution when viewed by a victim. Please note that this issue only affects users who have modelines and filetype plugins enabled, which is not the default. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-1138 to this issue.

All users of VIM are advised to upgrade to these erratum packages, which contain a backported patch for this issue.

The remote host is affected by the vulnerability described in GLSA-200412-10 (Vim, gVim: Vulnerable options in modelines)

    Gentoo's Vim maintainer, Ciaran McCreesh, found several     vulnerabilities related to the use of options in Vim modelines. Options     like 'termcap', 'printdevice', 'titleold', 'filetype', 'syntax',     'backupext', 'keymap', 'patchmode' or 'langmenu' could be abused.
  Impact :

    A local attacker could write a malicious file in a world readable     location which, when opened in a modeline-enabled Vim, could trigger     arbitrary commands with the rights of the user opening the file,     resulting in privilege escalation. Please note that modelines are     disabled by default in the /etc/vimrc file provided in Gentoo.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
20670	Ubuntu 4.10 : vim vulnerability (USN-52-1)	Nessus	Ubuntu Local Security Checks	high
19103	FreeBSD : vim -- vulnerabilities in modeline handling (bd9fc2bf-5ffe-11d9-a11a-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	high
17170	RHEL 4 : vim (RHSA-2005:036)	Nessus	Red Hat Local Security Checks	high
16116	Mandrake Linux Security Advisory : vim (MDKSA-2005:003)	Nessus	Mandriva Local Security Checks	high
16109	RHEL 2.1 / 3 : vim (RHSA-2005:010)	Nessus	Red Hat Local Security Checks	high
15971	GLSA-200412-10 : Vim, gVim: Vulnerable options in modelines	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2004-1138

high

Tenable Plugins

high

high

high

high

high

high