Chiwopsezo mu Vim chomwe chimatsogolera kukuphatikizika kwamakhodi pomwe fayilo yoyipa imatsegulidwa

Mumalemba olemba Vim ΠΈ neovim anapeza kusatetezeka (CVE-2019-12735), yomwe imalola kuti code yosagwirizana ichitike mukatsegula fayilo yopangidwa mwapadera. Vuto limapezeka pamene njira yokhazikika yachitsanzo (": set modeline") ikugwira ntchito, yomwe imakulolani kufotokozera zosankha zosintha mu fayilo yosinthidwa. Chiwopsezo chokhazikika pazotulutsa
Vim 8.1.1365 ΠΈ Neovim 0.3.6.

Zosankha zochepa zokha zitha kukhazikitsidwa kudzera pa modeline. Ngati mawu atchulidwa ngati mtengo wosankha, amachitidwa mu sandbox mode, yomwe imalola magwiridwe antchito otetezeka okha. Pankhaniyi, lamulo lovomerezeka limaphatikizapo lamulo la ": source", momwe mungagwiritsire ntchito "!" modifier. kuti muthamangitse malamulo osasintha kuchokera pafayilo yotchulidwa. Chifukwa chake, kuti mupereke kachidindoyo, ndikokwanira kuwonetsa mumzere wachitsanzo chomanga ngati "set foldexpr=execute('\:source! some_file'):". Ku Neovim, kuyimba foni ndikoletsedwa, koma assert_fails angagwiritsidwe ntchito m'malo mwake.

Mwachitsanzo, kuti muthamangitse lamulo la "uname -a", ingotsegulani fayilo ku Vim kapena Neovim yomwe mzere wake woyamba kapena womaliza umati:

:!uname -a||Β» vi:fen:fdm=expr:fde=assert_fails(β€œgwero\!\\%”):fdl=0:fdt=”

Kampani "source! %" adzawerenga malamulo omwe ali mufayilo yomwe ilipo ndipo potero achite ":!uname -a". Njira zothawirako zitha kugwiritsidwa ntchito kubisa mzere womwe waperekedwa kuti usatuluke ndi zida zamphaka. Mwachitsanzo, mu izi kugwiritsa ntchito prototype Mukatsegula fayilo mu vim, kulumikizidwa kwa netiweki kumapangidwa ndi chipolopolo chofikira pamakina a wozunzidwayo, koma fayiloyi sidzadzutsa kukayikira mukatulutsa ku terminal pogwiritsa ntchito mphaka.

Mukhoza kuyang'ana ntchito ya modeline ndi lamulo ": set modeline?". Kuti muyimitse, mutha kuwonjezera mzere "set nomodeline" ku vimrc. M'magawidwe vuto limakhazikika RHEL, SUSE/OpenSUSE, Fedora, FreeBSD, Ubuntu, Arch Linux ΠΈ ALT. Chiwopsezocho sichinasinthidwe Debian (mu Debian modeline woyimitsidwa mwachisawawa, chifukwa chake chiwopsezo sichimawonekera mwachisawawa).

Source: opennet.ru

Kuwonjezera ndemanga