CVE-2008-3294

Vim 5.0-7.1, Python build: Insecure Makefile-conf ownership and permissions allow code execution by local users

• CVSS 3.7
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Authentication, Authorization, and Session Management
• Local

src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it ahead of time with permissions that prevent its modification by configure.

CVE

CVE-2008-3294

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

3.7

Published

2008-07-24

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Timing/Serialization

Code defect classification

Timing Issues

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Vim to version 7.2 or higher.

import os
import tempfile

def create_makefile_conf():
    temp_file_name = tempfile.mktemp(prefix='Makefile-conf-')
    with open(temp_file_name, 'w') as temp_file:
        temp_file.write("# Makefile configuration\n")
    
    with open(temp_file_name, 'r') as file:
        print(file.read())
    
    os.remove(temp_file_name)

create_makefile_conf()

import os
import tempfile
import stat

def create_makefile_conf():
    with tempfile.NamedTemporaryFile(delete=False) as temp_file:
        temp_file_name = temp_file.name
        temp_file.write(b"# Makefile configuration\n")
    
    os.chmod(temp_file_name, stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH)
    
    try:
        with open(temp_file_name, 'r') as file:
            print(file.read())
    finally:
        os.remove(temp_file_name)

create_makefile_conf()

@misc{vaitp:cve20083294,
  title        = {{Vim 5.0-7.1, Python build: Insecure Makefile-conf ownership and permissions allow code execution by local users}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2008},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2008-3294},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2008-3294/}}
}