(Turbo Linux Issues Fix) Re: The Vim Text Editor Allows Local Users to Obtain Escalated Privileges
SecurityTracker Alert ID: 1001616|
SecurityTracker URL: http://securitytracker.com/id/1001616
(Links to External Site)
Date: May 26 2001
User access via local system|
Fix Available: Yes Vendor Confirmed: Yes |
SuSE announced a vulnerability in the "vim" and "gvim" text editor utilities that allows local users to escalate their privileges.|
It is reported that vim, ("Vi IMproved") contains a tmp race condition and that vim commands contained in regular files may be executed if the status line of vim is enabled in the vimrc configuration file. Both vulnerabilities can be exploited by a local user to gain additional privileges.
Note that this vulnerability is not limited to just SuSE Linux.
A local user could obtain escalated privileges on the host.|
Turbo Linux issued a fix. See the Source Message for details.|
Vendor URL: www.vim.org/ (Links to External Site)
Linux (Turbo Linux)|
This archive entry is a follow-up to the message listed below.|
Source Message Contents
Date: Fri, 25 May 2001 15:40:15 -0700 (PDT)|
Subject: [TL-Security-Announce] TLSA2001025 vim-5.7-4
-----BEGIN PGP SIGNED MESSAGE-----
Turbolinux Security Announcement
Vulnerable Packages: All Turbolinux versions previous to 5.7-4
Date: 05/23/2001 5:00 PDT
Affected Turbolinux versions: TL Server 6.5,
TL Workstation 6.1,
TL Server 6.0.5 and earlier
Turbolinux Advisory ID#: TLSA2001025
Credits: First reported by Red Hat: RHSA-2001:008-02
A security hole has been fixed in the package vim. Please update the packages in your
installation as soon as possible.
1. Problem Summary
An attacker can create a text file embedded with potentially dangerous commands. By
opening this text file in VIM, the commands are executed with the privileges of the user
that opens the file. Hence, potential damage to a system can occur if a user were to
open this file as root.
For this vulnerability to be exploited, the ability to modify status lines has to be
activated. This is done by adjusting the setting of the parameter "stl" or "statusline"
in a file called ".vimrc".
Update the packages from our ftp server by running the following
rpm -Uvh ftp_path_to_filename
Where ftp_path_to_filename is the following:
The source RPM can be downloaded here:
**Note: You must rebuild and install the RPM if you choose to download
and install the SRPM. Simply installing the SRPM alone WILL NOT CLOSE
THE SECURITY HOLE.
To rebuild the vim packages on Turbolinux Workstation 6.1,
you must have the package "ctags" installed. To rebuild the package
on Turbolinux Server versions 6.0.5 and earlier, make sure you install
XFree86-devel, gtk+-devel, python-devel, gdbm-devel, and ncurses-devel.
Please verify the MD5 checksums of the updates before you install:
MD5 sum Package Name
These packages are GPG signed by Turbolinux for security. Our key
is available here:
To verify a package, use the following command:
rpm --checksig name_of_rpm
To examine only the md5sum, use the following command:
**Note: Checking GPG keys requires RPM 3.0 or higher.
You can find more updates on our ftp server:
for TL6.x Workstation and Server security updates
Our webpage for security announcements:
If you want to report vulnerabilities, please contact:
Subscribe to the Turbolinux Security Mailing lists:
TL-security - A moderated list for discussing security issues
Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security
TL-security-announce - An announce-only mailing list for security
updates and alerts.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: pgpenvelope 2.10.0 - http://pgpenvelope.sourceforge.net/
-----END PGP SIGNATURE-----
TL-Security-Announce mailing list