OS Command Injection in Vim - CVE-2019-12735

Vulnerability identifier: #VU31049

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12735

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

Vim
Gentoo Linux
Amazon Linux AMI
Arch Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Virtualization Host - Extended Update Support 4.2 for RHEL
Red Hat Enterprise Linux for x86_64
SUSE Linux
Opensuse
Fedora
neovim (Alpine package)
vim (Red Hat package)
vim
Red Hat Virtualization Host
Data Computing Appliance (DCA)
Dell PowerProtect Cyber Recovery
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Session Smart Router

Install update from vendor's website.

Vim - update to 8.1.1365
neovim (Alpine package) - update to 0.3.8-r0
Data Computing Appliance (DCA) - update to 3.5.4.0
Dell EMC Unity Operating Environment (OE) - update to 5.0.3.0.5.014
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.3.0.5.014
Session Smart Router - addressed in versions 5.4.7, 5.5.3
vim (Red Hat package) - addressed in versions 7.4.160-2.el7_4.1, 7.4.160-4.el7_5.1, 7.4.160-6.el7_6, 7.4.629-5.el6_10.2, 8.0.1763-11.el8_0
vim - addressed in versions 8.1.1471-1.fc29, 8.1.1471-1.fc30
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8

• Exploit #6074 - Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution (June 17, 2021)
• Exploit #5454 - cve-2019-12735 (Docker image that lets me study the exploitation of the VIM exploit) (May 20, 2021)

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00031.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00036.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00034.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00050.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00075.html
• http://www.securityfocus.com/bid/108724
• https://access.redhat.com/errata/RHSA-2019:1619
• https://access.redhat.com/errata/RHSA-2019:1774
• https://access.redhat.com/errata/RHSA-2019:1793
• https://access.redhat.com/errata/RHSA-2019:1947
• https://bugs.debian.org/930020
• https://bugs.debian.org/930024
• https://github.com/neovim/neovim/pull/10082
• https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md
• https://github.com/vim/vim/commit/53575521406739cf20bbe4e384d88e7dca11f040
• https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BMDSHTF754TITC6AQJPCS5IRIDMMIM7/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRIRBC2YRGKPAWVRMZS4SZTGGCVRVZPR/
• https://seclists.org/bugtraq/2019/Jul/39
• https://seclists.org/bugtraq/2019/Jun/33
• https://security.gentoo.org/glsa/202003-04
• https://support.f5.com/csp/article/K93144355
• https://support.f5.com/csp/article/K93144355?utm_source=f5support&utm_medium=RSS
• https://usn.ubuntu.com/4016-1/
• https://usn.ubuntu.com/4016-2/
• https://www.debian.org/security/2019/dsa-4467
• https://www.debian.org/security/2019/dsa-4487

• OS Command Injection in Vim Vim
• OpenSUSE Linux update for neovim
• OpenSUSE Linux update for neovim
• OpenSUSE Linux update for neovim
• OpenSUSE Linux update for vim
• OpenSUSE Linux update for vim
• OpenSUSE Linux update for neovim
• OS Command Injection in neovim (Alpine package)
• Arch Linux update for gvim
• Arch Linux update for vim
• Amazon Linux AMI update for vim
• Gentoo update for Vim, gVim
• Multiple vulnerabilities in Juniper Networks Session Smart Router
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in Dell EMC Cyber Recovery
• Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8 update for vim
• Red Hat Enterprise Linux 6 update for vim
• Red Hat Enterprise Linux 7.5 Extended Update Support update for vim
• Red Hat Enterprise Linux 7.4 Extended Update Support update for vim
• Fedora 30 update for vim
• Fedora 29 update for vim
• Dell EMC Unity update for third-party components