Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion.

Midnight Commander uses a fixed sized stack buffer while resolving symbolic links within file archives (tar or cpio). If an attacker can cause a user to process a specially crafted file archive with Midnight Commander, the attacker may be able to obtain the privileges of the target user.

A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive (such as a .tar file) could cause arbitrary code to be executed if opened by Midnight Commander.

The remote host is affected by the vulnerability described in GLSA-200403-09 (Buffer overflow in Midnight Commander)

    A stack-based buffer overflow has been found in Midnight Commander's     virtual filesystem.
  Impact :

    This overflow allows an attacker to run arbitrary code on the user's     computer during the symlink conversion process.
  Workaround :

    While a workaround is not currently known for this issue, all users are     advised to upgrade to the latest version of the affected package.

A buffer overflow was discovered in mc's virtual filesystem code. This vulnerability could allow remote attackers to execute arbitrary code during symlink conversion.

The updated packages have been patched to correct the problem.

- Sat Jan 31 2004 Jakub Jelinek <jakub at redhat.com>     4.6.0-8.4

  - fix previous patch

  - Fri Jan 30 2004 Jakub Jelinek <jakub at redhat.com>     4.6.0-8.3

  - update php.syntax file (#112645)

    - fix crash with large syntax file (#112644)

  - Fri Jan 23 2004 Jakub Jelinek <jakub at redhat.com>     4.6.0-8.2

  - update CVE-2003-1023 fix to still make vfs symlinks     relative, but with bounds checking

  - Sat Jan 17 2004 Warren Togami <wtogami at redhat.com>     4.6.0-8.1

  - rebuild for FC1

  - Sat Jan 17 2004 Warren Togami <wtogami at redhat.com>     4.6.0-7

  - BuildRequires glib2-devel, slang-devel, XFree86-devel,     e2fsprogs-devel, gettext

  - Copyright -> License

    - PreReq -> Requires

    - Explicit zero epoch in versioned dev dep

    - /usr/share/mc directory ownership

    - Improve summary

    - (Seth Vidal QA) fix for CVE-2003-1023 (Security)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated mc packages that resolve a buffer overflow vulnerability are now available.

Midnight Commander is a visual shell much like a file manager.

A buffer overflow has been found in Midnight Commander's virtual filesystem code. Specifically, a stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c allows remote attackers to execute arbitrary code during symlink conversion.

Users of Midnight Commander should install these updated packages, which resolve this issue.

ID	Name	Product	Family	Severity
37593	FreeBSD : Midnight Commander buffer overflow during symlink resolution (322d4ff6-85c3-11d8-a41f-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	high
15261	Debian DSA-424-1 : mc - buffer overflow	Nessus	Debian Local Security Checks	high
14460	GLSA-200403-09 : Buffer overflow in Midnight Commander	Nessus	Gentoo Local Security Checks	high
14107	Mandrake Linux Security Advisory : mc (MDKSA-2004:007)	Nessus	Mandriva Local Security Checks	high
13671	Fedora Core 1 : mc-4.6.0-8.4 (2004-058)	Nessus	Fedora Local Security Checks	high
12456	RHEL 2.1 : mc (RHSA-2004:035)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-1023

critical

Tenable Plugins

high

high

high

high

high

high