Description
src/configure.in in Vim 5.0 through 7.1, when used for a build with Python support, does not ensure that the Makefile-conf temporary file has the intended ownership and permissions, which allows local users to execute arbitrary code by modifying this file during a time window, or by creating it ahead of time with permissions that prevent its modification by configure.
References
- 20080717 Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution mailing-list
- 20080718 Re: Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution mailing-list
- ADV-2008-2146 vdb-entry
- 31681 vdb-entry
- 20080717 Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution mailing-list
- 31159 third-party-advisory
- 32222 third-party-advisory
- ADV-2008-2780 vdb-entry
- APPLE-SA-2008-10-09 vendor-advisory
- http://support.apple.com/kb/HT3216
- 20080725 Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution mailing-list