Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by causing mc to free unallocated memory.

Andrew V. Samoilov reported several vulnerabilities that were corrected in MidnightCommand 4.6.0 :

- Format string issues (CVE-2004-1004)

- Buffer overflows (CVE-2004-1005)

- Denial-of-service, infinite loop (CVE-2004-1009)

- Denial-of-service, corrupted section header (CVE-2004-1090)

- Denial-of-service, NULL pointer dereference (CVE-2004-1091)

- Freeing unallocated memory (CVE-2004-1092)

- Using already freed memory (CVE-2004-1093)

The remote host is affected by the vulnerability described in GLSA-200502-24 (Midnight Commander: Multiple vulnerabilities)

    Midnight Commander contains several format string vulnerabilities     (CAN-2004-1004), buffer overflows (CAN-2004-1005), a memory     deallocation error (CAN-2004-1092) and a buffer underflow     (CAN-2004-1176).
  Impact :

    An attacker could exploit these vulnerabilities to execute     arbitrary code with the permissions of the user running Midnight     Commander or cause Denial of Service by freeing unallocated memory.
  Workaround :

    There is no known workaround at this time.

Andrew V. Samoilov has noticed that several bugfixes which were applied to the source by upstream developers of mc, the midnight commander, a file browser and manager, were not backported to the current version of mc that Debian ships in their stable release. The Common Vulnerabilities and Exposures Project identifies the following vulnerabilities :

  - CAN-2004-1004     Multiple format string vulnerabilities

  - CAN-2004-1005

    Multiple buffer overflows

  - CAN-2004-1009

    One infinite loop vulnerability

  - CAN-2004-1090

    Denial of service via corrupted section header

  - CAN-2004-1091

    Denial of service via null dereference

  - CAN-2004-1092

    Freeing unallocated memory

  - CAN-2004-1093

    Denial of service via use of already freed memory

  - CAN-2004-1174

    Denial of service via manipulating non-existing file     handles

  - CAN-2004-1175

    Unintended program execution via insecure filename     quoting

  - CAN-2004-1176

    Denial of service via a buffer underflow

ID	Name	Product	Family	Severity
18884	FreeBSD : mc -- multiple vulnerabilities (2b2b333b-6bd3-11d9-95f8-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	high
17138	GLSA-200502-24 : Midnight Commander: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
16165	Debian DSA-639-1 : mc - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2004-1092

high

Tenable Plugins

high

high

high