1. CVE-Search
  2. CVE-2008-4677
ID CVE-2008-4677
Summary autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."
References
Vulnerable Configurations
  • cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:*
    cpe:2.3:a:vim:vim:7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:*
    cpe:2.3:a:vim:vim:7.1.266:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:*
    cpe:2.3:a:vim:vim:7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:109:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:109:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:110:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:110:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:111:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:111:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:112:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:112:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:113:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:113:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:114:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:114:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:115:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:115:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:116:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:116:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:118:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:118:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:120:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:120:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:121:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:121:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:122:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:122:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:123:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:123:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:128:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:128:*:*:*:*:*:*:*
  • cpe:2.3:a:vim:netrw:131:*:*:*:*:*:*:*
    cpe:2.3:a:vim:netrw:131:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 08-08-2017 - 01:32)
Impact:
Exploitability:
CWE CWE-255
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:N/A:N
refmap via4
bid 30670
bugtraq
  • 20080812 Re: Vim: Netrw: FTP User Name and Password Disclosure
  • 20080812 Vim: Netrw: FTP User Name and Password Disclosure
confirm https://bugzilla.redhat.com/show_bug.cgi?id=461750
mandriva MDVSA-2008:236
misc http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
mlist
  • [oss-security] 20081006 CVE request - (vim : netrw plugin - ftp user credentials disclosure)
  • [oss-security] 20081016 CVE request - Vim netrw.plugin
  • [oss-security] 20081020 CVE request (vim)
  • [vim_dev] 20080817 Re: Anyone fixing SA31464?
secunia
  • 31464
  • 34418
suse SUSE-SR:2009:007
vupen ADV-2008-2379
xf vim-netrw-ftp-information-disclosure(44419)
statements via4
contributor Tomas Hoger
lastmodified 2008-10-25
organization Red Hat
statement Not vulnerable. This issue did not affect the versions of vim as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.
Last major update 08-08-2017 - 01:32
Published 22-10-2008 - 18:00
Last modified 08-08-2017 - 01:32
Back to Top