Title: Vim Insecure Temporary File Creation Vulnerability
Severity: MODERATE
Description:
Vim is a freely available text editor.
Vim creates temporary files in an insecure manner. Specifically, the issue presents itself because the 'src/configure.in' script file uses a temporary file with a predictable name of the form: '/tmp/Makefile-conf<PID>'.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks to overwrite arbitrary files in the context of the affected application. Or, the attacker may add arbitrary shell commands to the temporary file to be executed in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files and execute arbitrary commands in the context of the user building Vim.
This issue affects all versions from Vim 5.0 to 7.1 (the current version); Vim 4.6 and 3.0 are not vulnerable.
Affected Products:
- Caldera OpenLinux 2.3.0
- Conectiva Linux 8.0.0
- MandrakeSoft Corporate Server 2.1.0
- MandrakeSoft Corporate Server 2.1.0 x86_64
- MandrakeSoft Corporate Server 3.0.0
- MandrakeSoft Corporate Server 3.0.0 x86_64
- MandrakeSoft Linux Mandrake 10.0.0
- MandrakeSoft Linux Mandrake 10.0.0 amd64
- MandrakeSoft Linux Mandrake 10.1.0
- MandrakeSoft Linux Mandrake 10.1.0 x86_64
- MandrakeSoft Linux Mandrake 2007.0
- MandrakeSoft Linux Mandrake 2007.0 x86_64
- MandrakeSoft Linux Mandrake 2007.1
- MandrakeSoft Linux Mandrake 2007.1 x86_64
- MandrakeSoft Linux Mandrake 7.2.0
- MandrakeSoft Linux Mandrake 8.0.0
- MandrakeSoft Linux Mandrake 8.0.0 ppc
- MandrakeSoft Linux Mandrake 8.1.0
- MandrakeSoft Linux Mandrake 8.1.0 ia64
- MandrakeSoft Linux Mandrake 8.2.0
- MandrakeSoft Linux Mandrake 8.2.0 ppc
- MandrakeSoft Linux Mandrake 9.0.0
- MandrakeSoft Multi Network Firewall 2.0.0
- MandrakeSoft Single Network Firewall 7.2.0
- RedHat Fedora Core1
- RedHat Linux 5.2.0
- RedHat Linux 5.2.0 alpha
- RedHat Linux 5.2.0 i386
- RedHat Linux 5.2.0 sparc
- RedHat Linux 6.2.0
- RedHat Linux 6.2.0 alpha
- RedHat Linux 6.2.0 i386
- RedHat Linux 6.2.0 sparc
- RedHat Linux 7.0.0
- RedHat Linux 7.0.0 alpha
- RedHat Linux 7.0.0 i386
- RedHat Linux 7.0.0 sparc
- RedHat Linux 7.1.0 i386
- RedHat Linux 7.1.0 ia64
- RedHat Linux 7.2.0 i386
- RedHat Linux 7.2.0 ia64
- RedHat Linux 7.3.0 i386
- RedHat Linux 8.0.0
- RedHat Linux 9.0.0 i386
- RedHat Linux for iSeries 7.1.0
- RedHat Linux for pSeries 7.1.0
- S.u.S.E. Linux 6.1.0
- S.u.S.E. Linux 6.2.0
- S.u.S.E. Linux 6.3.0
- S.u.S.E. Linux 6.4.0
- S.u.S.E. Linux 7.0.0
- S.u.S.E. Linux 7.1.0
- SCO OpenLinux Server 3.1.1
- SCO OpenLinux Workstation 3.1.1
- SCO eDesktop 2.4.0
- SCO eServer 2.3.1
- Sun Cobalt Qube 3
- Sun Cobalt RaQ 4
- Sun Cobalt RaQ 550
- Sun Cobalt RaQ XTR
- Sun Linux 5.0.6
- Ubuntu Ubuntu Linux 6.10 amd64
- Ubuntu Ubuntu Linux 6.10 i386
- Ubuntu Ubuntu Linux 6.10 powerpc
- Ubuntu Ubuntu Linux 6.10 sparc
- Ubuntu Ubuntu Linux 7.04 amd64
- Ubuntu Ubuntu Linux 7.04 i386
- Ubuntu Ubuntu Linux 7.04 powerpc
- Ubuntu Ubuntu Linux 7.04 sparc
- VIM Development Group VIM 5.0.0
- VIM Development Group VIM 5.1.0
- VIM Development Group VIM 5.2.0
- VIM Development Group VIM 5.3.0
- VIM Development Group VIM 5.4.0
- VIM Development Group VIM 5.5.0
- VIM Development Group VIM 5.6.0
- VIM Development Group VIM 5.7.0
- VIM Development Group VIM 5.8.0
- VIM Development Group VIM 6.0.0
- VIM Development Group VIM 6.1.0
- VIM Development Group VIM 6.2.0
- VIM Development Group VIM 6.3.0
- VIM Development Group VIM 6.4
- VIM Development Group VIM 7.0
- VIM Development Group VIM 7.1
- VIM Development Group VIM 7.1
References:
- Apple: About Security Update 2008-007
- Apple: Mac OS X Home Page
- VIM Development Group: VIM Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
