Vim Swap File Race Condition Vulnerability

BID:2927

Info

Vim Swap File Race Condition Vulnerability

Bugtraq ID: 2927
Class: Race Condition Error
CVE:
Remote: No
Local: Yes
Published: Apr 10 2001 12:00AM
Updated: Apr 10 2001 12:00AM
Credit: Published in a SuSE Security Advisory on April 11, 2001.
Vulnerable: VIM Development Group VIM 5.7
+ Caldera OpenLinux 2.3
+ Redhat Linux 7.0 sparc
 + Redhat Linux 7.0 i386
 + Redhat Linux 7.0 alpha
 + Redhat Linux 7.0
+ Redhat Linux 6.2 sparc
 + Redhat Linux 6.2 i386
 + Redhat Linux 6.2 alpha
 + Redhat Linux 5.2 sparc
 + Redhat Linux 5.2 i386
 + Redhat Linux 5.2 alpha
 + Redhat Linux 5.2
+ Redhat Linux 6.2
 + SCO eDesktop 2.4
+ SCO eServer 2.3.1
+ SuSE Linux 7.1
+ SuSE Linux 7.0
+ SuSE Linux 6.4
+ SuSE Linux 6.3
+ SuSE Linux 6.2
+ SuSE Linux 6.1
VIM Development Group VIM 5.6
VIM Development Group VIM 5.5
VIM Development Group VIM 5.4
VIM Development Group VIM 5.3
VIM Development Group VIM 5.2
VIM Development Group VIM 5.1
VIM Development Group VIM 5.0
Not Vulnerable:

Discussion

Vim Swap File Race Condition Vulnerability

Vim is an enhanced version of the popular text editor vi.

A race condition vulnerability exists in the swap file mechanism used by the 'vim' program. The error occurs when a swap file name for a file being opened is symbolically linked to a non-existent file.

By conjecturing the name of a file to be edited by another user, it may be possible for a local user to create a malicious symbolic link to a non-existent file. This could cause the new target file to be created with the permissions of the user running vim.

Exploit / POC

Vim Swap File Race Condition Vulnerability

The following exploit was submitted by <[email protected]>:

Solution / Fix

Vim Swap File Race Condition Vulnerability

Solution:
Vendor updates that rectify this issue are available:


VIM Development Group VIM 5.7

References

Vim Swap File Race Condition Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report