{"id":35246,"date":"2019-10-31T22:03:12","date_gmt":"2019-10-31T19:03:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla\/"},"modified":"2019-10-31T22:03:12","modified_gmt":"2019-10-31T19:03:12","slug":"uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla","title":{"rendered":"Vulnerabilit\u00e0 in Vim che consente l'esecuzione di codice aprendo file dannosi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Negli editor testuali Vim<\/a><\/noindex> e Neovim<\/a><\/noindex> \u00e8 stata una vulnerabilit\u00e0<\/a><\/noindex> (CVE-2019-12735<\/a><\/noindex>), che consente di eseguire codice arbitrario aprendo un file appositamente formattato. Il problema si manifesta quando \u00e8 attivo il mode modeline («:set modeline»), che permette di definire le opzioni di editing nel file trattato. La vulnerabilit\u00e0 \u00e8 stata corretta nelle versioni
\nVim 8.1.1365<\/a><\/noindex> e Neovim 0.3.6<\/a><\/noindex>.<\/p>\n

Attraverso il modeline \u00e8 possibile impostare solo un numero limitato di opzioni. Se come valore dell'opzione viene indicata un'espressione, questa viene eseguita in modalit\u00e0 sandbox, che consente solo operazioni sicure di base. Tra di esse \u00e8 inclusa il comando «:source», nel quale si pu\u00f2 utilizzare il modificatore «!» per eseguire comandi arbitrari dal file specificato. Pertanto, per eseguire codice \u00e8 sufficiente indicare nella riga del modeline una costruzione del tipo «set foldexpr=execute(‘\:source! some_file’):». In Neovim la chiamata a execute \u00e8 vietata, ma pu\u00f2 essere utilizzato assert_fails.<\/p>\n

Ad esempio, per eseguire il comando «uname -a» \u00e8 sufficiente aprire in Vim o Neovim un file la cui prima o ultima riga contenga:<\/p>\n

:!uname -a||» vi:fen:fdm=expr:fde=assert_fails(«source\!\ \%»):fdl=0:fdt=»<\/p>\n

Il comando «source! %» legger\u00e0 i comandi dal file corrente e, di conseguenza, eseguir\u00e0 «:!uname -a». Per nascondere questa riga dall'output della utility cat possono essere utilizzate sequenze di escape. Ad esempio, in questo durante l'esecuzione di operazioni di copia dal contenitore, si \u00e8 riusciti a effettuare un attacco con successo in meno dell'1% dei casi, cambiando ciclicamente il collegamento simbolico nel percorso utilizzato per l'operazione di copia (l'attacco \u00e8 riuscito dopo circa 10 secondi di tentativi continui per copiare il file con il comando \u00abdocker cp\u00bb).<\/a><\/noindex> aprendo un file in vim si crea una connessione di rete con accesso shell al sistema vittima, ma questo file non susciter\u00e0 sospetti quando viene visualizzato nel terminale dalla utility cat.<\/p>\n

Per verificare l'attivazione della modalit\u00e0 modeline \u00e8 possibile utilizzare il comando «:set modeline?». Per disattivarla in vimrc, puoi aggiungere la riga «set nomodeline». La problematica \u00e8 stata risolta nelle distribuzioni RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, Arch Linux<\/a><\/noindex> e ALT<\/a><\/noindex>. La vulnerabilit\u00e0 rimane non corretta in Debian<\/a><\/noindex> (in Debian la modeline \u00e8 disattivata di default, quindi nella sua configurazione predefinita la vulnerabilit\u00e0 non si manifesta).<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0445 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430\u0445 Vim \u0438 Neovim \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-12735), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 modeline («:set modeline»), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0432 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043e\u043f\u0446\u0438\u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Vim 8.1.1365 \u0438 Neovim 0.3.6. \u0427\u0435\u0440\u0435\u0437 modeline \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u043e\u043f\u0446\u0438\u0439. \u0415\u0441\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35246","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 in Vim che porta all'esecuzione di codice aprendo un file dannoso | ProHoster","description":"\u00c8 stata trovata una vulnerabilit\u00e0 nei editor di testo Vim e Neovim (CVE-2019-12735) che consente l'esecuzione di codice arbitrario all'apertura di un file appositamente formattato. Il problema si manifesta con l'attivazione, per impostazione predefinita, della modalit\u00e0 modeline (\":set modeline\"), che permette di definire nelle opzioni di editing del file trattato. La vulnerabilit\u00e0 \u00e8 stata risolta nelle versioni Vim 8.1.1365 e Neovim 0.3.6. Tramite modeline \u00e8 consentita solo l'impostazione di un numero limitato di opzioni. Se","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Vim, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 | ProHoster","og:description":"\u0412 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0445 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430\u0445 Vim \u0438 Neovim \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-12735), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 modeline (":set modeline"), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0432 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043e\u043f\u0446\u0438\u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Vim 8.1.1365 \u0438 Neovim 0.3.6. \u0427\u0435\u0440\u0435\u0437 modeline \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u043e\u043f\u0446\u0438\u0439. \u0415\u0441\u043b\u0438","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:03:12+00:00","article:modified_time":"2019-10-31T19:03:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35246","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 22:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:07:29","updated":"2026-01-21 22:31:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/35246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=35246"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/35246\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=35246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=35246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=35246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}