VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file
    ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways
    not intended by the user running the vi binary. (CVE-2017-1000382)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file     ([ORIGINAL_FILENAME].swp) resulting in files that may be world readable or otherwise accessible in ways     not intended by the user running the vi binary. (CVE-2017-1000382)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the vim package has been released.

ID	Name	Product	Family	Type	Severity
459276	Echo: vim: security update to 2:9.2.0218-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459276	Echo: vim: security update to 2:9.2.0218-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
220104	Linux Distros Unpatched Vulnerability : CVE-2017-1000382	Nessus	Misc.	Local	medium
121973	Photon OS 2.0: Vim PHSA-2018-2.0-0076	Nessus	PhotonOS Local Security Checks	Local	medium
121867	Photon OS 1.0: Vim PHSA-2018-1.0-0167	Nessus	PhotonOS Local Security Checks	Local	medium

Detections

Analytics

CVE-2017-1000382

medium

Tenable Plugins

medium

medium

medium

medium

medium