Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Wednesday June 12 2019, @11:37PM   Printer-friendly
from the cue-the-EMACS-laughter dept.

Submitted via IRC for SoyCow1944

Linux Command-Line Editors Vulnerable to High-Severity Bug

A bug impacting editors Vim and Neovim could allow a trojan code to escape sandbox mitigations.

A high-severity bug impacting two popular command-line text editing applications, Vim and Neovim, allow remote attackers to execute arbitrary OS commands. Security researcher Armin Razmjou warned that exploiting the bug is as easy as tricking a target into clicking on a specially crafted text file in either editor.

Razmjou outlined his research and created a proof-of-concept (PoC) attack demonstrating how an adversary can compromise a Linux system via Vim or Neowim [sic]. He said Vim versions before 8.1.1365 and Neovim before 0.3.6 are vulnerable to arbitrary code execution.

“[Outlined is] a real-life attack approach in which a reverse shell is launched once the user opens the file. To conceal the attack, the file will be immediately rewritten when opened. Also, the PoC uses terminal escape sequences to hide the modeline when the content is printed with cat. (cat -v reveals the actual content),” wrote Razmjou in a technical analysis of his research.

[...] “However, the :source! command (with the bang [!] modifier) can be used to bypass the sandbox. It reads and executes commands from a given file as if typed manually, running them after the sandbox has been left,” according to the PoC report.

Vim and Neovim have both released patches for the bug (CVE-2019-12735) that the National Institute of Standards and Technology warns, “allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline.”

“Beyond patching, it’s recommended to disable modelines in the vimrc (set nomodeline), to use the securemodelinesplugin, or to disable modelineexpr (since patch 8.1.1366, Vim-only) to disallow expressions in modelines,” the researcher said.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2, Funny) by Anonymous Coward on Thursday June 13 2019, @12:37AM (1 child)

    by Anonymous Coward on Thursday June 13 2019, @12:37AM (#854940)

    No it won't, it's too big to load.

    Starting Score:    0  points
    Moderation   +2  
       Funny=2, Total=2
    Extra 'Funny' Modifier   0  

    Total Score:   2  
  • (Score: 4, Funny) by maxwell demon on Thursday June 13 2019, @08:08AM

    by maxwell demon (1608) on Thursday June 13 2019, @08:08AM (#855041) Journal

    Maybe you should finally upgrade your machine to more than 8 megabytes.

    (Emacs = Eight Megabytes And Continuously Swapping)

    --
    The Tao of math: The numbers you can count are not the real numbers.