CVE-2009-0316
Vulnerability from cvelistv5
Published
2009-01-28 11:00
Modified
2024-08-07 04:31
Severity ?
EPSS score ?
Summary
Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:31:25.468Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305"
},
{
"name": "33447",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/33447"
},
{
"name": "[oss-security] 20090126 CVE request -- Python \u003c 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"
},
{
"name": "APPLE-SA-2010-03-29-1",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
},
{
"name": "[debian-bugs-rc] 20080805 Bug#484305: bicyclerepair: bike.vim imports untrusted python files from cwd",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.apple.com/kb/HT4077"
},
{
"name": "MDVSA-2009:047",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:047"
},
{
"name": "vim-pysyssetargv-privilege-escalation(48275)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48275"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481565"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-01-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305"
},
{
"name": "33447",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/33447"
},
{
"name": "[oss-security] 20090126 CVE request -- Python \u003c 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"
},
{
"name": "APPLE-SA-2010-03-29-1",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
},
{
"name": "[debian-bugs-rc] 20080805 Bug#484305: bicyclerepair: bike.vim imports untrusted python files from cwd",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.apple.com/kb/HT4077"
},
{
"name": "MDVSA-2009:047",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:047"
},
{
"name": "vim-pysyssetargv-privilege-escalation(48275)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48275"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481565"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0316",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937",
"refsource": "CONFIRM",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937"
},
{
"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305",
"refsource": "MISC",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305"
},
{
"name": "33447",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/33447"
},
{
"name": "[oss-security] 20090126 CVE request -- Python \u003c 2.6 PySys_SetArgv issues (epiphany, csound, dia, eog, gedit, xchat, vim, nautilus-python, Gnumeric)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2009/01/26/2"
},
{
"name": "APPLE-SA-2010-03-29-1",
"refsource": "APPLE",
"url": "http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html"
},
{
"name": "[debian-bugs-rc] 20080805 Bug#484305: bicyclerepair: bike.vim imports untrusted python files from cwd",
"refsource": "MLIST",
"url": "http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html"
},
{
"name": "https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045",
"refsource": "CONFIRM",
"url": "https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045"
},
{
"name": "http://support.apple.com/kb/HT4077",
"refsource": "CONFIRM",
"url": "http://support.apple.com/kb/HT4077"
},
{
"name": "MDVSA-2009:047",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:047"
},
{
"name": "vim-pysyssetargv-privilege-escalation(48275)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48275"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=481565",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=481565"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-0316",
"datePublished": "2009-01-28T11:00:00",
"dateReserved": "2009-01-27T00:00:00",
"dateUpdated": "2024-08-07T04:31:25.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2009-0316\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-01-28T11:30:00.297\",\"lastModified\":\"2024-11-21T00:59:37.100\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Untrusted search path vulnerability in src/if_python.c in the Python interface in Vim before 7.2.045 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983), as demonstrated by an erroneous search path for plugin/bike.vim in bicyclerepair.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de ruta de b\u00fasqueda no confiable en el archivo src/if_python.c en la interfaz de Python en Vim en versiones anteriores a 7.2.045, permite a los usuarios locales ejecutar c\u00f3digo arbitrario por medio de un archivo Python de tipo caballo de Troya en el directorio de trabajo actual, relacionado con una vulnerabilidad en la funci\u00f3n PySys_SetArgv (CVE- 2008-5983), como es demostrado por una ruta de b\u00fasqueda err\u00f3nea para el archivo plugin/bike.vim en bicyclerepair.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":6.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.4,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"7.2\",\"matchCriteriaId\":\"DC771166-EF16-4755-ABD4-9390F366FE92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CEC67AF-3A8F-421E-BC74-16DA592DAC1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:1.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E7C9C8A-CA6F-4781-98EE-03B78A91D860\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E1B91822-8DC4-471C-B6D4-EC7F114914B4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12B90731-2B67-4859-A873-EFEFE4A66CF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F325C23E-BFBC-4371-AF74-E189FC2515F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2527B955-E25A-4A33-A6F4-27DEDA99C7F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BEA82FC2-F2A3-4BE2-8EE2-5A3BC3555401\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"808C36C4-0523-4FBC-B3B7-3E6E29FF24EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"404E256E-B823-4BC4-8F29-C3724604F474\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75F0563C-7156-4166-87AA-4C122F26CABB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CDFBFEB-D79E-4CEB-905E-FA89A0F0D494\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AAEC13F6-0526-47FB-BF98-D864CE297D60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:5.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"477A2C0C-5229-4A08-8AB1-B9C8C2D4F3FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9FE70D0-5931-49D1-A750-7D03C8C28228\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A08C510-8774-4FEB-BCA3-1868F692BF94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"464D5E9A-EB5A-47AB-8657-15A68AD30D59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F4F51CA-18C1-4043-B4E6-F1AD9D3C1346\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2BAA6B0-4956-4D98-872A-BCCBD0D4CE16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97CCAA40-55CE-4AB9-9268-AADA06E29B9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8C5B265-A7DD-4D24-864C-BF1FEEF8F138\"}]}]}],\"references\":[{\"url\":\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.apple.com/kb/HT4077\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:047\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2009/01/26/2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/33447\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=481565\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/48275\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=484305\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=493937\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://support.apple.com/kb/HT4077\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2009:047\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2009/01/26/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/33447\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=481565\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/48275\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://svn.pardus.org.tr/pardus/2008/applications/editors/vim/files/official/7.2.045\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.