Georgi Guninski has reported a vulnerability in vim, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to an error that allows the "glob()" command to be exploited to execute shell commands when the user opens a specially crafted file.

Successful exploitation allows command execution with privileges of the vim user, but requires the "modelines" option to be enabled and the user is tricked into opening a malicious file.

The vulnerability has been reported in versions prior to 6.3.082.

Solution
Update to version 6.3.082 or later.

Provided and/or discovered by
Georgi Guninski

Changelog
Further details available in Customer Area

Original Advisory
Georgi Guninski:
http://www.guninski.com/where_do_you_want_billg_to_go_today_5.html

VIM:
ftp://ftp.vim.org/pub/vim/patches/6.3/README

Deep Links
Links available in Customer Area