The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files.

Javier Fernandez-Sanguino Pena noticed that the auxillary scripts 'tcltags' and 'vimspell.sh' created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the script (either by calling it directly or by execution through vim).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:036 advisory.

    VIM (Vi IMproved) is an updated and improved version of the vi screen-based     editor.

    Ciaran McCreesh discovered a modeline vulnerability in VIM.  An attacker     could create a text file containing a specially crafted modeline which     could cause arbitrary command execution when viewed by a victim using VIM.
    The Common Vulnerabilities and Exposures project has assigned the name     CAN-2004-1138 to this issue.  Please note that this issue only affects     users who have modelines and filetype plugins enabled, which is not the     default.

    The Debian Security Audit Project discovered an insecure temporary file     usage in VIM.  A local user could overwrite or create files as a different     user who happens to run one of the the vulnerable utilities.  The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-0069 to this issue.

    All users of VIM are advised to upgrade to these erratum packages,     which contain backported patches for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated vim packages that fix a security vulnerability are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

VIM (Vi IMproved) is an updated and improved version of the vi screen-based editor.

The Debian Security Audit Project discovered an insecure temporary file usage in VIM. A local user could overwrite or create files as a different user who happens to run one of the the vulnerable utilities.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0069 to this issue.

All users of VIM are advised to upgrade to these erratum packages, which contain a backported patche for this issue.

Javier Fernandez-Sanguino Pena discovered two vulnerabilities in scripts included with the vim editor. The two scripts, 'tcltags' and 'vimspell.sh' created temporary files in an insecure manner which could allow a malicious user to execute a symbolic link attack or to create, or overwrite, arbitrary files with the privileges of the user invoking the scripts.

The updated packages are patched to prevent this problem.

ID	Name	Product	Family	Severity
20680	Ubuntu 4.10 : vim vulnerabilities (USN-61-1)	Nessus	Ubuntu Local Security Checks	medium
17170	RHEL 4 : vim (RHSA-2005:036)	Nessus	Red Hat Local Security Checks	high
17148	RHEL 2.1 / 3 : vim (RHSA-2005:122)	Nessus	Red Hat Local Security Checks	medium
16302	Mandrake Linux Security Advisory : vim (MDKSA-2005:029)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2005-0069

medium

Tenable Plugins

medium

high

medium

medium