VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file     ([ORIGINAL_FILENAME].swp) resulting in files that may be world readable or otherwise accessible in ways     not intended by the user running the vi binary. (CVE-2017-1000382)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the vim package has been released.

An update of 'vim', 'blktrace', 'systemd' packages of Photon OS has been released.

ID	Name	Product	Family	Severity
220104	Linux Distros Unpatched Vulnerability : CVE-2017-1000382	Nessus	Misc.	medium
121973	Photon OS 2.0: Vim PHSA-2018-2.0-0076	Nessus	PhotonOS Local Security Checks	medium
121867	Photon OS 1.0: Vim PHSA-2018-1.0-0167	Nessus	PhotonOS Local Security Checks	medium
111960	Photon OS 2.0: Blktrace / Systemd / Vim PHSA-2018-2.0-0076 (deprecated)	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2017-1000382

medium

Tenable Plugins

medium

medium

medium

medium