Nuglaanta Vim ee u horseedaysa fulinta kood marka la furayo faylka xaasidnimada ah

Ku jira tifaftirayaasha qoraalka Vim и neovim helay nuglaanta (CVE-2019-12735), kaas oo u ogolaanaya kood aan sabab lahayn in la fuliyo marka la furayo fayl si gaar ah loo qaabeeyey. Dhibaatadu waxay dhacdaa marka qaabka caadiga ah ee moodeelka (": set modeline") uu firfircoon yahay, kaas oo kuu ogolaanaya inaad qeexdo doorashooyinka tafatirka ee faylka la farsameeyay. Nuglaanta ayaa go'an marka la sii daayo
Vim 8.1.1365 и Neovim 0.3.6.

Kaliya tiro xaddidan oo xulasho ah ayaa lagu rakibi karaa iyada oo loo marayo modeline. Haddii tibaaxaha lagu qeexo sida qiimaha ikhtiyaarka ah, waxaa lagu fuliyay qaabka sandbox, kaas oo u oggolaanaya kaliya hawlgallada badbaadada ee ugu fudud. Xaaladdan oo kale, amarka ansax ah waxaa ka mid ah amarka ": source", kaas oo aad isticmaali karto "!" modifier. si aad amarro aan sabab lahayn uga socodsiiso faylka la cayimay. Markaa, si loo fuliyo koodka, waa ku filan tahay in lagu muujiyo xariiqda moodeelka dhisme sida “set foldexpr=execute('\:source! some_file'):”. Gudaha Neovim, wacitaanka fulinta waa mamnuuc, laakiin assert_fails waa la isticmaali karaa beddelkeeda.

Tusaale ahaan, si aad u socodsiiso amarka "uname -a", si fudud u fur fayl gudaha Vim ama Neovim kaas oo xariiqiisa koowaad ama ugu dambeeya uu leeyahay:

:!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\%"):fdl=0:fdt="

Shirkadda "source! %" wuxuu akhrin doonaa amarrada faylka hadda jira oo si waafaqsan fulin doona ":! uname -a". Isku xigxiga baxsadka waxaa loo isticmaali karaa in lagu qariyo xariiq la siiyay wax soo saarka bisadaha. Tusaale ahaan, tan ka faa'iidayso prototype marka la furayo fayl gudaha vim, isku xirka shabakada ayaa la abuuraa iyada oo gelaysa qolofka nidaamka dhibbanaha, laakiin faylkani ma kicin doono shaki marka loo soo saaro terminalka iyadoo la isticmaalayo utility bisadaha.

Waxaad ku hubin kartaa dhaqdhaqaaqa qaabka modeline amarka ": set modeline?". Si aad u joojiso, waxaad ku dari kartaa khadka "set nomodeline" vimrc. Qaybinta dhibaatadu waxay ku xidhan tahay gudaha RHEL, SUSE/furanSUSE, Fedora, FreeBSD, Ubuntu, Arch Linux и ALT. Nuglaanta ayaa weli ah mid aan la daboolin Debian (in Debian modeline waa naafo si caadi ah, markaa nuglaanta kama muuqato xaalada caadiga ah).

Source: opennet.ru