Critical Vulnerability in VIM Package: Umask Ignored When Creating Swap Files
Summary
UBUNTU-CVE-2017-1000382: VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the... Affects vim versions 2:7.4.000-1ubuntu2 – 2:7.4.052-1ubuntu3.1+esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
VIM is a highly configurable text editor built to enable efficient text editing. It is widely used by developers and system administrators for its powerful features, including syntax highlighting, multi-level undo, and extensive plugin support. However, a vulnerability has been identified in certain versions of VIM that compromises file security by ignoring the umask setting when creating swap files, potentially exposing sensitive data.
Vulnerability Detail
The vulnerability, identified as CVE-2017-1000382, arises from VIM version 8.0.1187 and possibly other versions, which fails to respect the umask setting when generating swap files. This oversight can lead to swap files being created with permissions that allow unauthorized access, making them world-readable or accessible in unintended ways. As a result, sensitive information may be exposed to other users on the system, posing a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually adjust the permissions of the swap files after they are created to restrict access. This can be done using the command: 'chmod 600 [ORIGINAL_FILENAME].swp', where [ORIGINAL_FILENAME] is the name of the file being edited.
Conclusion
The vulnerability in VIM, CVE-2017-1000382, poses a significant risk by allowing unauthorized access to swap files due to improper handling of umask settings. It is crucial for users to update their VIM installations to the latest patched versions to mitigate this risk. In the meantime, applying the suggested workaround can help secure sensitive data.
See every vulnerability recorded for vim →
FAQ
CVE-2017-1000382 is a vulnerability in VIM that allows swap files to be created with insecure permissions, potentially exposing sensitive data.
Versions of VIM starting from 8.0.1187 and possibly earlier versions are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If an immediate update is not possible, consider using the workaround to change the permissions of swap files to restrict access.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for vim.
