CVE-2008-4677 : autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions,

autoload/netrw.vim (aka the Netrw Plugin) 109, 131, and other versions before 133k for Vim 7.1.266, other 7.1 versions, and 7.2 stores credentials for an FTP session, and sends those credentials when attempting to establish subsequent FTP sessions to servers on different hosts, which allows remote FTP servers to obtain sensitive information in opportunistic circumstances by logging usernames and passwords. NOTE: the upstream vendor disputes a vector involving different ports on the same host, stating "I'm assuming that they're using the same id and password on that unchanged hostname, deliberately."

Published 2008-10-22 18:00:01

Updated 2017-08-08 01:32:50

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2008-4677

Probability of exploitation activity in the next 30 days: 0.23%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 60 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2008-4677

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2008-4677

CWE-255

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2008-4677

Red Hat 2008-10-25

Not vulnerable. This issue did not affect the versions of vim as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References for CVE-2008-4677

http://www.openwall.com/lists/oss-security/2008/10/06/4
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html

[security-announce] SUSE Security Summary Report: SUSE-SR:2009:007 - openSUSE Security Announce - openSUSE Mailing Lists

CVEs referencing this url
http://www.securityfocus.com/bid/30670
http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html
http://www.securityfocus.com/archive/1/495436
https://bugzilla.redhat.com/show_bug.cgi?id=461750
http://www.openwall.com/lists/oss-security/2008/10/20/2

CVEs referencing this url
http://www.vupen.com/english/advisories/2008/2379
http://www.openwall.com/lists/oss-security/2008/10/16/2

CVEs referencing this url
http://www.securityfocus.com/archive/1/495432
http://groups.google.com/group/vim_dev/browse_thread/thread/2f6fad581a037971/a5fcf4c4981d34e6?show_docid=a5fcf4c4981d34e6
https://exchange.xforce.ibmcloud.com/vulnerabilities/44419
http://www.mandriva.com/security/advisories?name=MDVSA-2008:236

CVEs referencing this url

Products affected by CVE-2008-4677

VIM » Netrw » Version: 109
cpe:2.3:a:vim:netrw:109:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 131
cpe:2.3:a:vim:netrw:131:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 116
cpe:2.3:a:vim:netrw:116:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 118
cpe:2.3:a:vim:netrw:118:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 112
cpe:2.3:a:vim:netrw:112:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 113
cpe:2.3:a:vim:netrw:113:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 122
cpe:2.3:a:vim:netrw:122:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 123
cpe:2.3:a:vim:netrw:123:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 114
cpe:2.3:a:vim:netrw:114:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 115
cpe:2.3:a:vim:netrw:115:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 128
cpe:2.3:a:vim:netrw:128:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 110
cpe:2.3:a:vim:netrw:110:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 111
cpe:2.3:a:vim:netrw:111:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 120
cpe:2.3:a:vim:netrw:120:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2
VIM » Netrw » Version: 121
cpe:2.3:a:vim:netrw:121:*:*:*:*:*:*:*
Matching versions
When used together with: VIM » VIM » Version: 7.1
When used together with: VIM » VIM » Version: 7.1.266
When used together with: VIM » VIM » Version: 7.2

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!