Vim Insecure Temporary File Creation Vulnerability
BID:30279
Info
Vim Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 30279 |
| Class: | Design Error |
| CVE: |
CVE-2008-3294 |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 17 2008 12:00AM |
| Updated: | Oct 10 2008 04:47PM |
| Credit: | Jan Minár |
| Vulnerable: |
VIM Development Group VIM 6.3 VIM Development Group VIM 6.2 VIM Development Group VIM 6.1 VIM Development Group VIM 6.0 VIM Development Group VIM 5.8 VIM Development Group VIM 5.7 VIM Development Group VIM 5.6 VIM Development Group VIM 5.5 VIM Development Group VIM 5.4 VIM Development Group VIM 5.3 VIM Development Group VIM 5.2 VIM Development Group VIM 5.1 VIM Development Group VIM 5.0 VIM Development Group VIM 7.1 VIM Development Group VIM 7.1 VIM Development Group VIM 7.0 VIM Development Group VIM 6.4 |
| Not Vulnerable: | |
Discussion
Vim Insecure Temporary File Creation Vulnerability
Vim creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks to overwrite arbitrary files in the context of the affected application. Or, the attacker may add arbitrary shell commands to the temporary file to be executed in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files and execute arbitrary commands in the context of the user building Vim.
This issue affects all versions from Vim 5.0 to 7.1 (the current version); Vim 4.6 and 3.0 are not vulnerable.
Vim creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks to overwrite arbitrary files in the context of the affected application. Or, the attacker may add arbitrary shell commands to the temporary file to be executed in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files and execute arbitrary commands in the context of the user building Vim.
This issue affects all versions from Vim 5.0 to 7.1 (the current version); Vim 4.6 and 3.0 are not vulnerable.
Exploit / POC
Vim Insecure Temporary File Creation Vulnerability
An attacker uses readily available commands to exploit this issue.
An attacker uses readily available commands to exploit this issue.
Solution / Fix
Vim Insecure Temporary File Creation Vulnerability
Solution:
Apple has released updates and an advisory. Please see the references for more information.
Solution:
Apple has released updates and an advisory. Please see the references for more information.
References
Vim Insecure Temporary File Creation Vulnerability
References:
References:
- Mac OS X Homepage (Apple)
- VIM Homepage (VIM Development Group)
- Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitr (Robert Buchholz
- Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitr (
- Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitr ("Steven M. Christey"
- Re: Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution ("Nikolai Weibull"
- Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution (
- About Security Update 2008-007 (Apple)