CVE-2008-4677: Medium severity suse vim vulnerability

Description of problem (pasted from original rdancer.org vim vulnerability description -- see references):

The Vim Netrw Plugin shares the FTP user name and password across all FTP sessions. Every time Vim makes a new FTP connection, it sends the user name and password of the previous FTP session to the FTP server.

Once vim successfully connects to an FTP server using a user name and password credentials, it will re-use them in all subsequent FTP sessions, regardless of the domain name or TCP port.

This behaviour is documented, although the documentation states the credentials are retained on a per-session basis''. Apparently the Vim session, not the FTP session:

g:netrwuid (ftp) user-id, retained on a per-session basis s:netrwpasswd (ftp) password, retained on a per-session basis''

-- Netrw Reference Manual (pinetrw.txt'')

Although FTP communication is not encrypted and therefore open to eavesdropping, if the access to the network is protected, a credentials-based access control is meaningful, and the credentials must be kept secret.

Version-Release number of selected component (if applicable): 7.1.266, 7.2 and earlier versions of Vim

How reproducible: Always

Steps to Reproduce: 1. See "4. EXPLOIT" from the rdancer vim vulnerability report [1] Actual results: Credentials disclosure.

Expected results: Credentials are kept secret.

References (rdancer.org vim original vulnerability report):

[1] http://www.rdancer.org/vulnerablevim-netrw-credentials-dis.html

— Red Hat