4.3

CVE-2008-4677

autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords.  NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vim ≫ Netrw Version 109
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 110
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 111
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 112
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 113
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 114
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 115
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 116
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 118
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 120
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 121
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 122
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 123
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 128
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Vim ≫ Netrw Version 131
   Vim ≫ Vim Version 7.1
   Vim ≫ Vim Version 7.1.266
   Vim ≫ Vim Version 7.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.95% 0.776
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html
http://secunia.com/advisories/34418
http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
http://secunia.com/advisories/31464
Vendor Advisory
http://www.openwall.com/lists/oss-security/2008/10/06/4
http://www.openwall.com/lists/oss-security/2008/10/16/2
http://www.openwall.com/lists/oss-security/2008/10/20/2
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
http://www.securityfocus.com/archive/1/495432
http://www.securityfocus.com/archive/1/495436
http://www.securityfocus.com/bid/30670
http://www.vupen.com/english/advisories/2008/2379
https://bugzilla.redhat.com/show_bug.cgi?id=461750
https://exchange.xforce.ibmcloud.com/vulnerabilities/44419