{"id":35246,"date":"2019-10-31T22:03:12","date_gmt":"2019-10-31T19:03:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla\/"},"modified":"2019-10-31T22:03:12","modified_gmt":"2019-10-31T19:03:12","slug":"uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla","title":{"rendered":"Vulnerabilitet n\u00eb Vim, q\u00eb \u00e7on n\u00eb ekzekutimin e kodit kur hapet nj\u00eb skedar i d\u00ebmsh\u00ebm","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb redaktor\u00ebt e tekstit Vim<\/a><\/noindex> dhe Neovim<\/a><\/noindex> gjet vulnerabiliteti<\/a><\/noindex> (CVE-2019-12735<\/a><\/noindex>), e cila lejon q\u00eb t\u00eb ekzekutoni kod t\u00eb rast\u00ebsish\u00ebm duke hapur nj\u00eb file t\u00eb formatuar posa\u00e7\u00ebrisht. Problemi shfaqet kur \u00ebsht\u00eb aktiv moda modeline e cila \u00ebsht\u00eb aktive prej defaultit («:set modeline»), e cila lejon t\u00eb p\u00ebrcaktoni opsionet e redaktimit n\u00eb skedarin q\u00eb po p\u00ebrpunoni. D\u00ebmtueshm\u00ebria \u00ebsht\u00eb eliminuar n\u00eb l\u00ebshimet
\nVim 8.1.1365<\/a><\/noindex> dhe Neovim 0.3.6<\/a><\/noindex>.<\/p>\n

P\u00ebrmes modeline lejohet vet\u00ebm vendosja e nj\u00eb numri t\u00eb kufizuar opsionesh. N\u00ebse si vler\u00eb t\u00eb opsionit jepet nj\u00eb shprehje, ajo ekzekutohet n\u00eb nj\u00eb mod sandi, duke lejuar vet\u00ebm operacione t\u00eb thjeshta t\u00eb sigurta. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, n\u00eb numrin e lejuar t\u00eb operacioneve p\u00ebrfshihet komanda «:source», n\u00eb t\u00eb cil\u00ebn mund t\u00eb p\u00ebrdoret modifikatori «!» p\u00ebr t\u00eb ekzekutuar komanda t\u00eb rast\u00ebsishme nga skedari i specifikuar. Prandaj, p\u00ebr t\u00eb ekzekutuar kodin, mjafton t\u00eb p\u00ebrcaktoni n\u00eb linj\u00ebn modeline nj\u00eb konstruksion t\u00eb k\u00ebtij lloji «set foldexpr=execute(‘\:source! some_file’):». N\u00eb Neovim, thirrja execute \u00ebsht\u00eb e ndaluar, por n\u00eb vend t\u00eb tij mund t\u00eb p\u00ebrdorni assert_fails.<\/p>\n

P\u00ebr shembull, p\u00ebr t\u00eb ekzekutuar komand\u00ebn «uname -a», mjafton t\u00eb hapni n\u00eb Vim ose Neovim nj\u00eb skedar, n\u00eb rreshtin e par\u00eb ose t\u00eb fundit t\u00eb cilit \u00ebsht\u00eb e shkruar:<\/p>\n

:!uname -a||» vi:fen:fdm=expr:fde=assert_fails(«source\!\ \%»):fdl=0:fdt=»<\/p>\n

Komanda «source! %» do t\u00eb lexoj\u00eb komandat nga skedari aktual dhe, p\u00ebr rrjedhoj\u00eb, do t\u00eb ekzekutoj\u00eb «:!uname -a». P\u00ebr t\u00eb fshehur k\u00ebt\u00eb linj\u00eb nga output-i i utilitit cat, mund t\u00eb p\u00ebrdoren sekvencat e escape. P\u00ebr shembull, n\u00eb k\u00ebt\u00eb gjat\u00eb kryerjes s\u00eb operacioneve t\u00eb kopjimit nga kontejneri u arrit t\u00eb realizohej nj\u00eb sulm i suksessh\u00ebm n\u00eb m\u00eb pak se 1% t\u00eb rasteve gjat\u00eb z\u00ebvend\u00ebsimit ciklik t\u00eb lidhjes simbolike n\u00eb rrug\u00ebn e p\u00ebrdorur n\u00eb operacionin e kopjimit (sulmi i suksessh\u00ebm u realizua pas rreth 10 sekondash p\u00ebrpjekjesh t\u00eb vazhdueshme p\u00ebr t\u00eb kopjuar skedarin me komand\u00ebn \u00abdocker cp\u00bb).<\/a><\/noindex> kur hapet skeda n\u00eb vim krijohet nj\u00eb lidhje rrjeti me akses n\u00eb shell n\u00eb sistemin e viktim\u00ebs, por kjo sked\u00eb nuk do t\u00eb ngjall\u00eb dyshime gjat\u00eb daljes n\u00eb terminal nga utilitari cat.<\/p>\n

Kontrolli i aktivitetit t\u00eb mod\u00ebs modeline mund t\u00eb b\u00ebhet me komand\u00ebn «:set modeline?». P\u00ebr ta \u00e7aktivizuar n\u00eb vimrc, mund t\u00eb shtoni linj\u00ebn «set nomodeline». N\u00eb distribucione, problemi \u00ebsht\u00eb eliminuar n\u00eb RHEL<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, Arch Linux<\/a><\/noindex> dhe ALT<\/a><\/noindex>. Vulnerabiliteti mbetet i pap\u00ebrmir\u00ebsuar n\u00eb Debian<\/a><\/noindex> (n\u00eb Debian modeline \u00ebsht\u00eb \u00e7aktivizuar p\u00ebr parazgjedhje, k\u00ebshtu q\u00eb n\u00eb gjendjen e tij fillestare, vulnerabiliteti nuk shfaqet).<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0445 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430\u0445 Vim \u0438 Neovim \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-12735), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 modeline («:set modeline»), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0432 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043e\u043f\u0446\u0438\u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Vim 8.1.1365 \u0438 Neovim 0.3.6. \u0427\u0435\u0440\u0435\u0437 modeline \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u043e\u043f\u0446\u0438\u0439. \u0415\u0441\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35246","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabiliteti n\u00eb Vim q\u00eb \u00e7on n\u00eb ekzekutimin e kodit kur hapet nj\u00eb sked\u00eb keqdash\u00ebse | ProHoster","description":"N\u00eb redaktor\u00ebt e tekstit Vim dhe Neovim \u00ebsht\u00eb gjetur nj\u00eb vulnerabilitet (CVE-2019-12735), q\u00eb lejon ekzekutimin e kodit t\u00eb rast\u00ebsish\u00ebm kur hapet nj\u00eb sked\u00eb e ve\u00e7uar. Problemi shfaqet gjat\u00eb aktivizimit t\u00eb paracaktuar t\u00eb mod\u00ebs modeline (\":set modeline\"), e cila lejon p\u00ebrcaktimin e opsioneve t\u00eb redaktimit n\u00eb sked\u00ebn e trajtuar. Vulnerabiliteti \u00ebsht\u00eb rregulluar n\u00eb l\u00ebshimet Vim 8.1.1365 dhe Neovim 0.3.6. P\u00ebrmes modeline lejohet vendosja e nj\u00eb numri t\u00eb kufizuar opsionesh. N\u00ebse","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Vim, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 | ProHoster","og:description":"\u0412 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u044b\u0445 \u0440\u0435\u0434\u0430\u043a\u0442\u043e\u0440\u0430\u0445 Vim \u0438 Neovim \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-12735), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0440\u0435\u0436\u0438\u043c\u0430 modeline (":set modeline"), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0432 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0444\u0430\u0439\u043b\u0435 \u043e\u043f\u0446\u0438\u0438 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Vim 8.1.1365 \u0438 Neovim 0.3.6. \u0427\u0435\u0440\u0435\u0437 modeline \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u043e\u043f\u0446\u0438\u0439. \u0415\u0441\u043b\u0438","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-vim-privodyashhaya-k-vypolneniyu-koda-pri-otkrytii-vredonosnogo-fajla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:03:12+00:00","article:modified_time":"2019-10-31T19:03:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35246","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 22:31:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:07:29","updated":"2026-01-21 22:31:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/35246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=35246"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/35246\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=35246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=35246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=35246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}