Vulnerabilities > CVE-2005-0069 - Unspecified vulnerability in VIM Development Group VIM
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 4 |
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-122.NASL description Updated vim packages that fix a security vulnerability are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. VIM (Vi IMproved) is an updated and improved version of the vi screen-based editor. The Debian Security Audit Project discovered an insecure temporary file usage in VIM. A local user could overwrite or create files as a different user who happens to run one of the the vulnerable utilities. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0069 to this issue. All users of VIM are advised to upgrade to these erratum packages, which contain a backported patche for this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 17148 published 2005-02-18 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/17148 title RHEL 2.1 / 3 : vim (RHSA-2005:122) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-61-1.NASL description Javier Fernandez-Sanguino Pena noticed that the auxillary scripts last seen 2020-06-01 modified 2020-06-02 plugin id 20680 published 2006-01-15 reporter Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20680 title Ubuntu 4.10 : vim vulnerabilities (USN-61-1) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2005-029.NASL description Javier Fernandez-Sanguino Pena discovered two vulnerabilities in scripts included with the vim editor. The two scripts, last seen 2020-06-01 modified 2020-06-02 plugin id 16302 published 2005-02-03 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16302 title Mandrake Linux Security Advisory : vim (MDKSA-2005:029) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-036.NASL description Updated vim packages that fix security vulnerabilities are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. VIM (Vi IMproved) is an updated and improved version of the vi screen-based editor. Ciaran McCreesh discovered a modeline vulnerability in VIM. An attacker could create a text file containing a specially crafted modeline which could cause arbitrary command execution when viewed by a victim using VIM. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-1138 to this issue. Please note that this issue only affects users who have modelines and filetype plugins enabled, which is not the default. The Debian Security Audit Project discovered an insecure temporary file usage in VIM. A local user could overwrite or create files as a different user who happens to run one of the the vulnerable utilities. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0069 to this issue. All users of VIM are advised to upgrade to these erratum packages, which contain backported patches for these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 17170 published 2005-02-22 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/17170 title RHEL 4 : vim (RHSA-2005:036)
Oval
| accepted | 2013-04-29T04:19:10.653-04:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||
| description | The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files. | ||||||||||||||||||||
| family | unix | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:9402 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||
| title | The (1) tcltags or (2) vimspell.sh scripts in vim 6.3 allow local users to overwrite or create arbitrary files via a symlink attack on temporary files. | ||||||||||||||||||||
| version | 26 |
Redhat
| advisories |
| ||||||||
| rpms |
|
References
- http://marc.info/?l=bugtraq&m=110608387001863&w=2
- http://secunia.com/advisories/13841/
- http://securitytracker.com/id?1012938
- http://www.redhat.com/support/errata/RHSA-2005-036.html
- http://www.redhat.com/support/errata/RHSA-2005-122.html
- https://bugzilla.fedora.us/show_bug.cgi?id=2343
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18870
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9402