CVE-2017-17087

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-17087
fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://openwall.com/lists/oss-security/2017/11/27/2 Mailing List
http://security.cucumberlinux.com/security/details.php?id=166 Issue Tracking Third Party Advisory
https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 Patch Third Party Advisory
https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ Issue Tracking Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html Mailing List Third Party Advisory
https://usn.ubuntu.com/4582-1/ Third Party Advisory
http://openwall.com/lists/oss-security/2017/11/27/2 Mailing List
http://security.cucumberlinux.com/security/details.php?id=166 Issue Tracking Third Party Advisory
https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 Patch Third Party Advisory
https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ Issue Tracking Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html Mailing List Third Party Advisory
https://usn.ubuntu.com/4582-1/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vim:vim:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
History

21 Nov 2024, 03:17

Type Values Removed Values Added
References () http://openwall.com/lists/oss-security/2017/11/27/2 - Mailing List () http://openwall.com/lists/oss-security/2017/11/27/2 - Mailing List
References () http://security.cucumberlinux.com/security/details.php?id=166 - Issue Tracking, Third Party Advisory () http://security.cucumberlinux.com/security/details.php?id=166 - Issue Tracking, Third Party Advisory
References () https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 - Patch, Third Party Advisory () https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 - Patch, Third Party Advisory
References () https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ - Issue Tracking, Mailing List, Third Party Advisory () https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ - Issue Tracking, Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html - Mailing List, Third Party Advisory
References () https://usn.ubuntu.com/4582-1/ - Third Party Advisory () https://usn.ubuntu.com/4582-1/ - Third Party Advisory

20 Feb 2022, 05:58

Type Values Removed Values Added
CPE cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
References (MLIST) https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html - (MLIST) https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html - Mailing List, Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4582-1/ - (UBUNTU) https://usn.ubuntu.com/4582-1/ - Third Party Advisory
References (MISC) https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ - Mailing List (MISC) https://groups.google.com/d/msg/vim_dev/sRT9BtjLWMk/BRtSXNU4BwAJ - Issue Tracking, Mailing List, Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html - (MLIST) https://lists.debian.org/debian-lts-announce/2019/08/msg00003.html - Mailing List, Third Party Advisory
References (MISC) https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 - Patch (MISC) https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8 - Patch, Third Party Advisory
CWE CWE-200 CWE-668

11 Jan 2022, 00:15

Type Values Removed Values Added
References
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/01/msg00003.html -
Information

Published : 2017-12-01 08:29

Updated : 2024-11-21 03:17

NVD link : CVE-2017-17087

Mitre link : CVE-2017-17087

CVE.ORG link : CVE-2017-17087

JSON object : View

Products Affected

vim

  • vim

debian

  • debian_linux

canonical

  • ubuntu_linux
CWE
CWE-668

Exposure of Resource to Wrong Sphere