Midnight Commander Has Multiple Bugs That May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1009981 |
|
SecurityTracker URL: http://securitytracker.com/id/1009981
|
|
CVE Reference:
CAN-2004-0226, CAN-2004-0231, CAN-2004-0232
(Links to External Site)
|
Updated: May 14 2004
|
Original Entry Date: Apr 30 2004
|
Impact:
User access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
Several vulnerabilities were reported in Midnight Commander. A local user may be able to obtain elevated privileges.
Debian and Mandrake reported multiple vulnerabilities in Midnight Commander. The flaws include several buffer overflows [CVE: CAN-2004-0226], a format string vulnerability [CVE: CAN-2004-0232], and a temporary file and directory creation vulnerability [CVE: CAN-2004-0231].
Jacub Jelinek is credited with discovering the flaws.
|
Impact:
A local user may be able to gain the privileges of the user running mc.
|
Solution:
The report indicates that these flaws have been fixed in the upstream version.
[Editor's note: From minor code review, it appears that at least some of these flaws may have corrected as many as two years ago in the upstream version.]
|
Vendor URL: www.ibiblio.org/mc/ (Links to External Site)
|
Cause:
Access control error, Boundary error, Input validation error, State error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 29 Apr 2004 22:54:29 -0400
Subject: Midnight Commander vulnerabilities
|
Mandrake reported multiple vulnerabilities in Midnight Commander.
The flaws include several buffer overflows (CAN-2004-0226), a format string vulnerability
(CAN-2004-0232), and a temporary file and directory creation vulnerability (CAN-2004-0231).
Jacub Jelinek is credited with discovering the flaws.
|
|
