Information disclosure in Vim



| Updated: 2020-07-23
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-17087
CWE-ID CWE-200
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Vim
Client/Desktop applications / Software for system administration

Vendor Vim.org

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Information disclosure

EUVDB-ID: #VU31389

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-17087

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Vim: 8.0.0000 - 8.0.1262

CPE2.3 External links

https://openwall.com/lists/oss-security/2017/11/27/2
https://security.cucumberlinux.com/security/details.php?id=166
https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8
https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ
https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###