Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 15 Jun 2019 09:41:24 -0600
From:      Adam Weinberger <adamw@freebsd.org>
To:        Alexey Dokuchaev <danfe@freebsd.org>
Cc:        Adam Weinberger <adamw@freebsd.org>, ports-committers@freebsd.org,  svn-ports-all@freebsd.org, svn-ports-head@freebsd.org
Subject:   Re: svn commit: r504132 - head/security/vuxml
Message-ID:  <CAP7rwcjB9moLnEwzUcn0EhfKpF%2BdDvAObY0O8XJOn0V4HXByYA@mail.gmail.com>
In-Reply-To: <20190615151247.GA24087@FreeBSD.org>
References:  <201906131841.x5DIfuSb069885@repo.freebsd.org> <20190615151247.GA24087@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Jun 15, 2019 at 9:12 AM Alexey Dokuchaev <danfe@freebsd.org> wrote:
>
> On Thu, Jun 13, 2019 at 06:41:56PM +0000, Adam Weinberger wrote:
> > New Revision: 504132
> > URL: https://svnweb.freebsd.org/changeset/ports/504132
> >
> > Log:
> >   Add entry for Vim/NeoVim arbitrary code execution
> >
> > Modified:
> >   head/security/vuxml/vuln.xml
>
> Do we package Vim/NeoVim with modelines enabled by default?
>
> I've seen people say that in some distributions, default packages were not
> affected because their maintainers deliberately disable modelines, e.g. in
> Debian from 2007:
>
>   * debian/runtime/debian.vim.in
>     - set 'nomodeline' by default since modelines have historically been a
>       source of security/resource vulnerabilities.  Users should have to
>       explicitly enable the option to assume the associated risks.
>
> Also, from Gentoo's /etc/vim/vimrc:
>
>     We don't allow modelines by default. See bug #14088 and bug #73715.
>     basis by adding "set modeline" to your ~/.vimrc file.
>
> This sounds like a good idea.  Actually, any similar feature that allows to
> execute something based on user input should be disabled by default, because
> these things are very hard to get right (unless you're Daniel Bernstein).

Their default packages ARE affected. If your car explodes in 6th gear,
you can't say your car isn't affected because it starts up in first.
Whether they're enabled or disabled by default, the package is still
vulnerable.

# Adam


-- 
Adam Weinberger
adamw@adamw.org // adamw@FreeBSD.org
https://www.adamw.org



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAP7rwcjB9moLnEwzUcn0EhfKpF%2BdDvAObY0O8XJOn0V4HXByYA>