AIX Open Source

AIX Open Source

Share your experiences and connect with fellow developers to discover how to build and manage open source software for the AIX operating system

 View Only
Expand all | Collapse all

Update of vim required (CVE-2023-5344)

  • 1.  Update of vim required (CVE-2023-5344)

    Posted Wed February 07, 2024 02:38 AM

    Hey OpenSource-Team,

    CVE-2023-5344 describes a security issue in vim, so it would be good to update the rpm to the newest version. Unfortunately, vim is really often affected by vulnerabilities. It would therefore be nice to receive updates more frequently.

    Many thanks in advance



    ------------------------------
    Niklas
    System Engineer UNIX and Linux on Power
    ------------------------------


  • 2.  RE: Update of vim required (CVE-2023-5344)

    Posted Fri February 09, 2024 08:35 AM

    Hi,

    I am curious!

    What vim features are you using that are not supported by AIX / UNIX vi?

    Cheers, Nigel



    ------------------------------
    nigel griffiths
    ------------------------------



  • 3.  RE: Update of vim required (CVE-2023-5344)

    Posted Mon February 12, 2024 06:22 AM

    Hi Nigel,

    AFAIK code coloring is not supported by AIX/UNIX vi. For me that is a helpful tool to find and fix syntax errors, in shell, perl and python scripts I write.

    Same goes for multi-level undo and redo.

    One of the quality-of-life features is to convert characters to lower case or upper case using ed/vi movements, for example "gu$" converts all upper case characters from where the cursor is to the end of line, and "gU^" converts all lower case characters to uppercase characters from where the cursor is to the beginning of the line. IIRC same can be done in vi, but it might not be as simple as examples I've given.

    Other quality-of-life feature is that I can use <TAB> to complete filenames when <ESC>:r or <ESC>:w is is not supported by AIX/UNIX vi.



    ------------------------------
    Esa Kärkkäinen
    ------------------------------



  • 4.  RE: Update of vim required (CVE-2023-5344)

    Posted Tue February 13, 2024 04:10 AM

    Hey Esa,

    many thanks for sharing your experience. This is exactly what our users also use and they use it in the same way on AIX and Linux.

    Best regards



    ------------------------------
    Niklas
    System Engineer UNIX and Linux on Power
    ------------------------------



  • 5.  RE: Update of vim required (CVE-2023-5344)

    Posted Wed February 14, 2024 08:28 AM

    FYI  -  "ESC-|"

    "Escape - PIPE" will do line completion for me in AIX. I'm using Korn shell and vi.



    ------------------------------
    Vinny G
    ------------------------------



  • 6.  RE: Update of vim required (CVE-2023-5344)

    Posted Wed February 14, 2024 10:31 AM
    ksh93 supports tab completion and arrow keys.

    It cannot be set as the root shell, however you can run it immediately
    after login as root.

    On Wed, Feb 14, 2024 at 01:28:24PM +0000, Vinny G via IBM TechXchange Community wrote:
    > FYI - "ESC-|"
    >
    >
    > "Escape - PIPE" will do line completion for me in AIX. I'm using Korn shell and vi.
    >
    >
    > ------------------------------
    > Vinny G
    > ------------------------------
    > -------------------------------------------
    > Original Message:
    > Sent: Tue February 13, 2024 04:09 AM
    > From: Niklas V.
    > Subject: Update of vim required (CVE-2023-5344)
    >
    >
    > Hey Esa,
    >
    > many thanks for sharing your experience. This is exactly what our users also use and they use it in the same way on AIX and Linux.
    >
    > Best regards
    >
    >
    > ------------------------------
    > Niklas
    > System Engineer UNIX and Linux on Power
    > ------------------------------
    >
    > Original Message:
    > Sent: Mon February 12, 2024 06:21 AM
    > From: Esa K?rkk?inen
    > Subject: Update of vim required (CVE-2023-5344)
    >
    >
    > Hi Nigel,
    >
    > AFAIK code coloring is not supported by AIX/UNIX vi. For me that is a helpful tool to find and fix syntax errors, in shell, perl and python scripts I write.
    >
    > Same goes for multi-level undo and redo.
    >
    > One of the quality-of-life features is to convert characters to lower case or upper case using ed/vi movements, for example "gu$" converts all upper case characters from where the cursor is to the end of line, and "gU^" converts all lower case characters to uppercase characters from where the cursor is to the beginning of the line. IIRC same can be done in vi, but it might not be as simple as examples I've given.
    >
    > Other quality-of-life feature is that I can use <tab> to complete filenames when <esc>:r or <esc>:w is is not supported by AIX/UNIX vi.
    >
    >
    >
    >
    > ------------------------------
    > Esa K?rkk?inen
    >
    > Original Message:
    > Sent: Fri February 09, 2024 08:34 AM
    > From: nigel griffiths
    > Subject: Update of vim required (CVE-2023-5344)
    >
    >
    > Hi,
    >
    > I am curious!
    >
    > What vim features are you using that are not supported by AIX / UNIX vi?
    >
    > Cheers, Nigel
    >
    >
    > ------------------------------
    > nigel griffiths
    >
    > Original Message:
    > Sent: Wed February 07, 2024 02:37 AM
    > From: Niklas V.
    > Subject: Update of vim required (CVE-2023-5344)
    >
    >
    > Hey OpenSource-Team,
    >
    > CVE-2023-5344 describes a security issue in vim, so it would be good to update the rpm to the newest version. Unfortunately, vim is really often affected by vulnerabilities. It would therefore be nice to receive updates more frequently.
    >
    > Many thanks in advance
    >
    >
    > ------------------------------
    > Niklas
    > System Engineer UNIX and Linux on Power
    > ------------------------------
    >
    >
    > Reply to Sender : https://community.ibm.com/community/user/eGroups/PostReply?GroupId=6211&MID=397847&SenderKey=fbb0574f-5e32-4019-bd74-20f6f074dd57
    >
    > Reply to Discussion : https://community.ibm.com/community/user/eGroups/PostReply?GroupId=6211&MID=397847
    >
    >
    >
    > You are subscribed to "AIX Open Source" as Russell.Adams@AdamsSystems.nl. To change your subscriptions, go to http://community.ibm.com/community/user/preferences?section=Subscriptions. To unsubscribe from this community discussion, go to http://community.ibm.com/HigherLogic/eGroups/Unsubscribe.aspx?UserKey=c23dfccc-9910-40ae-beeb-fdcbced5bf1f&sKey=KeyRemoved&GroupKey=af5415f8-d8d8-4ac4-b3cb-08a8da184054.


    ------------------------------------------------------------------
    Russell Adams Russell.Adams@AdamsSystems.nl
    Principal Consultant Adams Systems Consultancy
    https://adamssystems.nl/




  • 7.  RE: Update of vim required (CVE-2023-5344)

    Posted Thu February 15, 2024 04:58 AM

    Don't mix ksh and vi. ksh has filename completion - both ksh88 and ksh93. AIX vi doesn't have it. This is the point and it is really time saving feature.

    I use AIX vi for most of my coding work and I hate syntax highlighting, but modern vim is way-way-way further in the feature list. With vim I can do something like very popular VSCode with file management, projects, and multiple tabs of editing files. Do I need it? Not really, but some of the features like what Esa wrote would be good to have.

    @Esa Kärkkäinen did you open a feature request on IBM's ideas portal? https://ibm-power-systems.ideas.ibm.com/ideas If you do it, please post the link to your idea here and I'll vote for it. Thank you!



    ------------------------------
    Andrey Klyachkin

    https://www.power-devops.com
    ------------------------------



  • 8.  RE: Update of vim required (CVE-2023-5344)

    Posted Thu February 15, 2024 06:57 AM

    Hi Andrey,

    No I hadn't considered opening a feature request regarding vi IBM's ideas portal. I'm not sure how much vim has diverged from the AT&T UNIX vi that is part of AIX user land code base, e.g. the amount of work required to implement one or more features that vim has in vi.

    Then there is point that original vi is just about bug free as software can be, which is very valuable in itself, especially when one has to operate in an very non-functional environment where other stuff has broken, and one has to fix one config file.

    When it comes to syntax highlighting it took me several months to get used to it and to get it tweaked like I want it to be, but once it is setup like I want it to be, all my vim settings can be copied very easily by running "scp -rp .vim* new_server:" to a new AIX, Linux or some other unix-like OS.

    One of the vi and vim features that I use and forgot to mention, is command history.

    For example when I'm editing a .html file and want to replace '   ' with ' wip ' and when I'm done replace ' wip ' with ' done ', I can get the command from the vi/vim command history, using arrow keys. IIRC vim has better command editing as well, which can also be done in vim using arrow keys.

    I don't especially want to write commands like this ":s/&nbsp;&nbsp;&nbsp;/\&nbsp;wip\&nbsp;/" from scratch for more than thirty times per .html file.

    Best regards,

    Esa



    ------------------------------
    Esa Kärkkäinen
    ------------------------------



  • 9.  RE: Update of vim required (CVE-2023-5344)

    Posted Fri February 16, 2024 06:29 AM

    Hi,

    The AIX vi won't be enhanced (nor replaced with vim).

    The whole point of it is that it's the standard, stable (cheap to maintain) and small (388KB) editor.

    On the other hand, vim depends on five non-IBM libraries (intl, sodium, ncurses, iconv, libgcc_s), so pulling VIM into the AIX base becomes pulling VIM, intl, sodium, ncurses, iconv, and gcc into the base.  Neither the business nor IP&L want that.

    Our best bet is to ask IBM to commit to properly fund and develop the aix/linux toolbox.



    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------



  • 10.  RE: Update of vim required (CVE-2023-5344)

    Posted Fri February 16, 2024 08:13 AM

    José 

    Totally agree. Don't meddle with the stable editor.

    I am of such a great age I remember the previous generation of UNIX (pre-AIX) kernel developers who would say "vi? is that the new fangled Visual editor? - that is for wimps!" There is nothing wrong with the "ed" editor. Don't forget UNIX was written using "ed"!

     And the device driver guys would say "ed" pointless luxury, there is nothing wrong with "echo .... >dd.c" redirected to a file. I think they were joking.

    AIX 1.1 or was i 2.1 arrived with INed editor for non-technical people. 
    One problem, if you edited an AIX system config file (anything in /etc) with it then INed could add 8 bit control characters to the file - invisibly.
    AIX would then fail to boot the next time you restarted it! 
    I gave early training course on basic AIX.  Day one, first hour, first sentence was: "Never ever use INed. In fact, its best to remove the INed program file completely. Lets do that right now."

    Showing my age here, but thanks for listening, N



    ------------------------------
    nigel griffiths
    ------------------------------



  • 11.  RE: Update of vim required (CVE-2023-5344)

    Posted Fri February 16, 2024 08:46 AM

    INed erradication was the first thing I did after AIX installation.

    It ticked all the wrong boxes: non-standard editor, easy to call by accident, totally dysfunctional, totally arbitrary limit for "long" files (65500 lines), self-admitted problems for some functions if the file is longer than 20000 lines, growing .index files, etc... For those that have no idea what we're talking about: http://www.mouritzen.dk/aix-doc/en_US/a_doc_lib/aixuser/inedguid/sysguidel.htm

    It was a wasted opportunity to not port IBM Personal Editor II to AIX.



    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------



  • 12.  RE: Update of vim required (CVE-2023-5344)

    Posted Fri February 16, 2024 09:52 AM

    It feels like in a dino park, guys ;-) 

    My first OS was CP/M and it didn't have any editor. It had only 6 commands - DIR, SAVE, ERA, REN, USER, TYPE. Do you see any editor here? OK, ED was usually delivered with CP/M - not the same ed you know from UNIX.

    One of my first UNIX OS was Interactive UNIX. If you remember AIX history, Interactive UNIX came from the same guys who was involved into AIX 1.0 development. INed came from them too. But on my box I had only ed. I was a junior administrator and used only what was installed by senior guys. So I still can work with ed.

    I also can create files with cat and dd and use echo instead of ls.

    I don't need any programming language - I still remember how I made my first programs by entering octal codes on the console. Why nobody is programming such way today?

    Do we really want to stay in the past just because we can do it and the grass was greener in our youth?

    It doesn't mean AIX should make vim as an official part of it. It can't be done - I fully agree with Jose. But is filename completion in vi so bad evil we should avoid in any case because it breaks our beloved operating system? Is AIX so bad that you don't trust IBM development to implement this simple feature and make lives of many people better?



    ------------------------------
    Andrey Klyachkin

    https://www.power-devops.com
    ------------------------------



  • 13.  RE: Update of vim required (CVE-2023-5344)

    Posted Fri February 16, 2024 10:07 AM

    It's not a matter of "evil" per-se, it's more a question of "once you start, where do you stop?", bash and vim are available from the toolbox.

    If anything, we should be contributing to the bash&vim projects to depend less on GNUisms and more on POSIX.  That way, they could be compiled on AIX without bringing along 5 external dependencies.



    ------------------------------
    José Pina Coelho
    IT Specialist at Kyndryl
    ------------------------------



  • 14.  RE: Update of vim required (CVE-2023-5344)

    Posted Fri February 16, 2024 10:38 AM

    No, Jose, you don't have to stop. We all should go forward as far as we can and then a little bit more.



    ------------------------------
    Andrey Klyachkin

    https://www.power-devops.com
    ------------------------------



  • 15.  RE: Update of vim required (CVE-2023-5344)

    Posted Tue February 13, 2024 10:15 AM

    Hi,

    Very useful information.

    Having used the original AT&T UNIX vi for 4 decades - I use a subset of vim out of habit.
    It seems I need to read the vim manual page or read some Hints&Tips webpages to learn all those newer time-saving vim features etc.

    Thanks for the feedback, N



    ------------------------------
    nigel griffiths
    ------------------------------



  • 16.  RE: Update of vim required (CVE-2023-5344)

    Posted Thu February 15, 2024 01:11 AM

    Hi Niklas,
    Thanks for reporting this. We are already working on it and will publish the new version soon.



    ------------------------------
    RESHMA KUMAR
    ------------------------------