Multiple vulnerabilities in Midnight Commander (mc) before 4.6.0, with unknown impact, related to "Insecure temporary file and directory creations."

Jakub Jelinek reports several security related bugs in Midnight Commander, including :

- Multiple buffer overflows (CVE-2004-0226)

- Insecure temporary file handling (CVE-2004-0231)

- Format string bug (CVE-2004-0232)

New mc packages are available for Slackware 9.0, 9.1, and -current to fix security issues that These could lead to a denial of service or the execution of arbitrary code as the user running mc. Sites that use mc should upgrade to the new mc package.

Jacub Jelinek discovered several vulnerabilities in the Midnight Commander, a powerful file manager for GNU/Linux systems. The problems were classified as follows :

 CAN-2004-0226 Buffer overflows CAN-2004-0231 Insecure temporary file  and directory creations CAN-2004-0232 Format string problems

The remote host is affected by the vulnerability described in GLSA-200405-21 (Midnight Commander: Multiple vulnerabilities)

    Numerous security issues have been discovered in Midnight Commander,     including several buffer overflow vulnerabilities, multiple vulnerabilities     in the handling of temporary file and directory creation, and multiple     format string vulnerabilities.
  Impact :

    The buffer overflows and format string vulnerabilities may allow attackers     to cause a denial of service or execute arbitrary code with permissions of     the user running MC. The insecure creation of temporary files and     directories could lead to a privilege escalation, including root     privileges, for a local attacker.
  Workaround :

    There is no known workaround at this time. All users are advised to upgrade     to version 4.6.0-r7 or higher of Midnight Commander.

Several vulnerabilities in Midnight Commander were found by Jacub Jelinek. This includes several buffer overflows (CVE-2004-0226), as well as a format string issue (CVE-2004-0232), and an issue with temporary file and directory creation (CVE-2004-0231). Most of the included fixes are backports from CVS, done by Andrew V. Samoilov and Pavel Roskin.

The updated packages are patched to correct these problems.

The remote host is missing the patch for the advisory SuSE-SA:2004:012 (mc).


The Midnight Commander (mc) is a file manager for the console.
The mc code is vulnerable to several security related bugs like buffer overflows, incorrect format string handling and insecure usage of temporary files.
These bugs can be exploited by local users to gain access to the privileges of the user running mc.

There is no workaround known other then avoid using mc.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Several buffer overflows, several temporary file creation vulnerabilities, and one format string vulnerability have been discovered in Midnight Commander. These vulnerabilities were discovered mostly by Andrew V. Samoilov and Pavel Roskin. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0226, CVE-2004-0231, and CVE-2004-0232 to these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated mc packages that resolve several buffer overflow vulnerabilities, one format string vulnerability and several temporary file creation vulnerabilities are now available.

Midnight Commander (mc) is a visual shell much like a file manager.

Several buffer overflows, several temporary file creation vulnerabilities, and one format string vulnerability have been discovered in Midnight Commander. These vulnerabilities were discovered mostly by Andrew V. Samoilov and Pavel Roskin. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0226, CVE-2004-0231, and CVE-2004-0232 to these issues.

Users should upgrade to these updated packages, which contain a backported patch to correct these issues.

ID	Name	Product	Family	Type	Severity
36588	FreeBSD : Midnight Commander buffer overflows, format string bugs, and insecure temporary file handling (0c6f3fde-9c51-11d8-9366-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	Local	critical
18761	Slackware 9.0 / 9.1 / current : mc (SSA:2004-136-01)	Nessus	Slackware Local Security Checks	Local	critical
15334	Debian DSA-497-1 : mc - several vulnerabilities	Nessus	Debian Local Security Checks	Local	critical
14507	GLSA-200405-21 : Midnight Commander: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
14138	Mandrake Linux Security Advisory : mc (MDKSA-2004:039)	Nessus	Mandriva Local Security Checks	Local	critical
13829	SuSE-SA:2004:012: mc	Nessus	SuSE Local Security Checks		critical
13693	Fedora Core 1 : mc-4.6.0-14.10 (2004-112)	Nessus	Fedora Local Security Checks	Local	critical
12489	RHEL 2.1 : mc (RHSA-2004:172)	Nessus	Red Hat Local Security Checks	Local	critical

Detections

Analytics

CVE-2004-0231

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical