Re: vim server ? security hole?

2006-07-29 Thread Nikolai Weibull
On 7/28/06, Yakov Lerner [EMAIL PROTECTED] wrote: On 7/28/06, Nikolai Weibull [EMAIL PROTECTED] wrote: On 7/27/06, Bram Moolenaar [EMAIL PROTECTED] wrote: Vim uses the X server for communication. Only users with write access to the X server can send a message to Vim. And if you have

Re: vim server ? security hole?

2006-07-28 Thread Nikolai Weibull
On 7/28/06, Marc Weber [EMAIL PROTECTED] wrote: In case it's a still a vim issue or we don't wont it it would be easy to add a accept_remote_orders_from_different_user and let vim send not only the command but also the username so the server might check.. I'll try to investigate some more time

Re: vim server ? security hole?

2006-07-28 Thread Yakov Lerner
On 7/28/06, Nikolai Weibull [EMAIL PROTECTED] wrote: On 7/27/06, Bram Moolenaar [EMAIL PROTECTED] wrote: Vim uses the X server for communication. Only users with write access to the X server can send a message to Vim. And if you have write access, you are also able to send keystrokes to

Re: vim server ? security hole?

2006-07-27 Thread Bram Moolenaar
Marc Weber wrote: I did notice that you can do su gvim :echo SERVERNAME and then using another user gvim --servername=GVIMxx --remote-send='!/dowhatyouwant ;-)' Thus: If you know your admin is using vim you can easily try to get one gvim instance to execute arbitrary commands as

Re: vim server ? security hole?

2006-07-27 Thread Nikolai Weibull
On 7/27/06, Bram Moolenaar [EMAIL PROTECTED] wrote: Vim uses the X server for communication. Only users with write access to the X server can send a message to Vim. And if you have write access, you are also able to send keystrokes to another process, thus you can do anything anyway. E.g.,

vim server ? security hole?

2006-07-26 Thread Marc Weber
I did notice that you can do su gvim :echo SERVERNAME and then using another user gvim --servername=GVIMxx --remote-send='!/dowhatyouwant ;-)' Thus: If you know your admin is using vim you can easily try to get one gvim instance to execute arbitrary commands as super user!! Don't think this

Re: vim server ? security hole?

2006-07-26 Thread Yakov Lerner
On 7/26/06, Marc Weber [EMAIL PROTECTED] wrote: I did notice that you can do su gvim :echo SERVERNAME and then using another user gvim --servername=GVIMxx --remote-send='!/dowhatyouwant ;-)' Marc, In case you are talking X11: D you have x11 authorization enabled or disabled ? Command 'xhost'

Re: vim server ? security hole?

2006-07-26 Thread Marc Weber
Marc, In case you are talking X11: D you have x11 authorization enabled or disabled ? I've been taking x11. I did modify xhost because I wanted a php script be able to launch vim. But I've restarted X now and xhost - shows the same as xhost. It still works. So c-rsystem('xhost') inserts:

Re: vim server ? security hole?

2006-07-26 Thread Yakov Lerner
On 7/26/06, Marc Weber [EMAIL PROTECTED] wrote: Marc, In case you are talking X11: D you have x11 authorization enabled or disabled ? I've been taking x11. I did modify xhost because I wanted a php script be able to launch vim. But I've restarted X now and xhost - shows the same as xhost. It

Re: vim server ? security hole?

2006-07-26 Thread David Brown
Marc Weber wrote: Marc, In case you are talking X11: D you have x11 authorization enabled or disabled ? I've been taking x11. I did modify xhost because I wanted a php script be able to launch vim. But I've restarted X now and xhost - shows the same as xhost. It still works. So

Re: vim server ? security hole?

2006-07-26 Thread James Vega
On Wed, Jul 26, 2006 at 10:20:05AM +0200, Marc Weber wrote: I did notice that you can do su gvim :echo SERVERNAME and then using another user gvim --servername=GVIMxx --remote-send='!/dowhatyouwant ;-)' Thus: If you know your admin is using vim you can easily try to get one gvim