______________________________________________________________________________

                        SuSE Security Announcement

        Package:                vim/gvim
        Announcement-ID:        SuSE-SA:2001:12
        Date:                   Tuesday, April 10th, 2001 15.23 MEST
        Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1
        Vulnerability Type:     local privilege escalation
        Severity (1-10):        5
        SuSE default package:   yes
        Other affected systems: all system using vim/gvim

        Content of this advisory:
        1) security vulnerability resolved: vim/gvim
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds
        3) standard appendix (further information)

______________________________________________________________________________

1)  problem description, brief discussion, solution, upgrade information

    The text editor vim, Vi IMproved, was found vulnerable to two security
    bugs.
    1.) a tmp race condition
    2.) vim commands in regular files will be executed if the status line
        of vim is enabled in vimrc
    Both vulnerabilities could be used to gain unauthorized access to more
    privileges.


    Download the update package from locations desribed below and install
    the package with the command `rpm -Uhv file.rpm'. The md5sum for each
    file is in the line below. You can verify the integrity of the rpm
    files using the command
        `rpm --checksig --nogpg file.rpm',
    independently from the md5 signatures below.



    vim:
    ----
    i386 Intel Platform:

    SuSE-7.1
      
      db368baa134c23b3578c8022a66d2703
    source rpm:
      
      00cf66142e477e24824410c8bf9e8702

    SuSE-7.0
      
      3a35734d8737c4f1e97ca9a6c1f68073
    source rpm:
      
      6275c8d938a7254e648ba33765613573

    SuSE-6.4
      
      7db6e43273fcfccf0f019246ba43fd05
    source rpm:
      
      f2d7177a61b1794068412ea687b9ecf6

    SuSE-6.3
      
      c12a03ff18235ea3421b18c48d6448af
    source rpm:
      
      b6e46176215691fc398fc6184e437a36

    SuSE-6.2
      
      a9f2154d991f9eb848dff3ffa1dcf430
    source rpm:
      
      8e554dbfe786562204039358df810984

    SuSE-6.1
      
      fcef6ade53f01ffe4cd8a7b8c033e176
    source rpm:
      
      e3d554b1354208ca6175c4757bab0373



    Sparc Platform:

    SuSE-7.1
      
      6746fc4eafc91ba5fa6d6377f22efdbd
    source rpm:
      
      de427c49af200e5fefa62a39959eaaaf

    SuSE-7.0
      
      7648859cc6a584ce1a2715cf7bc34bdc
    source rpm:
      
      934385ba01d59fc7bdd1bbaeca0cf260



    AXP Alpha Platform:

    SuSE-7.0
      
      ebe9dfc83dd1294b83d6b3aaad92fca0
    source rpm:
      
      038ab54d8a08f96b61118373f5e00948

    SuSE-6.4
      
      24d5f1365522d267650be44f80ab0b52
    source rpm:
      
      0a7a5bbde8e645254f4a5bd6cd402943

    SuSE-6.3
      
      b496518ea1640852e17ddb1274759fc4
    source rpm:
      
      1760adfac8e70bff334d74330acbefed

    SuSE-6.1
      
      dc633df2ac8fafa41c76d5c0216ed149
    source rpm:
      
      610088cca725fec62a4e7d6f1b030af1



    PPC PowerPC Platform:

    SuSE-7.0
      
      0b9ecb77901b15a90bf25623701d834b
    source rpm:
      
      3224f60fa80f27a9fb249a69c0ceaf01

    SuSE-6.4
      
      2044541d409bd756a166a75515214ffa
    source rpm:
      
      cac70ab3c2dee163d490bd85126f70aa




    gvim:
    -----
    i386 Intel Platform:

    SuSE-7.1
      
      066d163c43a6bb58f7a4a3770f179770
    source rpm:
      
      e6e92c8c4de39bd3a5899a55d6003d82

    SuSE-7.0
      
      16973a740f4a1fc2f2a189f036a10fe9
    source rpm:
      
      fecbd910f57b351e992f7b7015e3149b

    SuSE-6.4
      
      1700470566ac4fb2e5588771f07638ed
    source rpm:
      
      43a49e33acb8b9f017e6e5846ba636df

    SuSE-6.3
      
      db2abf1a9414b36466eb3d1186df5a7e
    source rpm:
      
      0b0b50b4987d594ee48a146e939f7152

    SuSE-6.2
      
      125171df7f45c80c10ea0fd52f944a6a
    source rpm:
      
      634e7b355274aed0af0fd7ac83218d78

    SuSE-6.1
      
      1d18996bf9666269db7893ae340e5642
    source rpm:
      
      9279a59d6eb1942186e1233c6f0ebcf1



    Sparc Platform:

    SuSE-7.0
      
      d415a24027510882b68d4ddcf1970ab4
    source rpm:
      
      57bfa58f0f7c46354edc78f0fc694d43



    AXP Alpha Platform:

    SuSE-6.4
      
      4cd25502d4ac5067fc64cd917ebd9018
    source rpm:
      
      347a84634805a6efa1ebf76df2a8ddb5

    SuSE-6.3
      
      5808f168b8632c85518d61ecec33e3d1
    source rpm:
      
      9402b1f0440b71a6aa0c1a60748dd26d

    SuSE-6.1
      
      b74d1cb6f7200d0bcf6ddbe1310e28c7
    source rpm:
      
      599e9ed0a326a9b86a6584f0a24ae4ad



    PPC PowerPC Paltform:

    SuSE-7.0
      
      27e579ff062662425a3581da6d08bce9
    source rpm:
      
      42a9a5b423848bbe381251c15a095a65

    SuSE-6.4
      
      07b386f3dbaca5c9b3f8c440ba59c782
    source rpm:
      
      4ddef3c55da33c3b548dd055d3d9b75b


______________________________________________________________________________

2)  Pending vulnerabilities in SuSE Distributions and Workarounds:

    - We are in the process of preparing update packages for the man package
      which has been found vulnerable to a commandline format string bug.
      The man command is installed suid man on SuSE systems. When exploited,
      the bug can be used to install a different man binary to introduce a
      trojan into the system. As an interim workaround, we recommend to
      `chmod -s /usr/bin/man´ and ignore the warnings and errors when
      viewing manpages.

    - A bufferoverflow in sudo was discovered and fixed RPMs will be
      available as soon as possible. A exploit was not made public until
      now.

    - NEdit a GUI-style text editor needs an update due to a tmp race
      condition. The source code is currently being reviewed and new
      RPMs will be available within the next days.

______________________________________________________________________________

3)  standard appendix:

    SuSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-security@suse.com
        -   general/linux/SuSE security discussion.
            All SuSE security announcements are sent to this list.
            To subscribe, send an email to
                <suse-security-subscribe@suse.com>.

    suse-security-announce@suse.com
        -   SuSE's announce-only mailing list.
            Only SuSE's security annoucements are sent to this list.
            To subscribe, send an email to
                <suse-security-announce-subscribe@suse.com>.

    For general information or the frequently asked questions (faq)
    send mail to:
        <suse-security-info@suse.com> or
        <suse-security-faq@suse.com> respectively.

    ==============================================    SuSE's security contact is <security@suse.com>.
    ==============================================
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way.
    SuSE GmbH makes no warranties of any kind whatsoever with respect
    to the information contained in this security advisory.