Buffer underflow in extfs.c in Midnight Commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code.

Various security bugs ranging from denial of service conditions to command execution have been fixed. (CVE-2004-1004, CVE-2004-1005, CVE-2004-1176)

Updated mc packages that fix multiple security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Midnight Commander (mc) is a visual shell, much like a file manager.

Several format string bugs were found in Midnight Commander. If a user is tricked by an attacker into opening a specially crafted path with mc, it may be possible to execute arbitrary code as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1004 to this issue.

Several buffer overflow bugs were found in Midnight Commander. If a user is tricked by an attacker into opening a specially crafted file or path with mc, it may be possible to execute arbitrary code as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1005 to this issue.

A buffer underflow bug was found in Midnight Commander. If a malicious local user is able to modify the extfs.ini file, it could be possible to execute arbitrary code as a user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1176 to this issue.

Users of mc should upgrade to these updated packages, which contain a backported patch, and are not vulnerable to this issue.

The remote host is affected by the vulnerability described in GLSA-200502-24 (Midnight Commander: Multiple vulnerabilities)

    Midnight Commander contains several format string vulnerabilities     (CAN-2004-1004), buffer overflows (CAN-2004-1005), a memory     deallocation error (CAN-2004-1092) and a buffer underflow     (CAN-2004-1176).
  Impact :

    An attacker could exploit these vulnerabilities to execute     arbitrary code with the permissions of the user running Midnight     Commander or cause Denial of Service by freeing unallocated memory.
  Workaround :

    There is no known workaround at this time.

Andrew V. Samoilov has noticed that several bugfixes which were applied to the source by upstream developers of mc, the midnight commander, a file browser and manager, were not backported to the current version of mc that Debian ships in their stable release. The Common Vulnerabilities and Exposures Project identifies the following vulnerabilities :

  - CAN-2004-1004     Multiple format string vulnerabilities

  - CAN-2004-1005

    Multiple buffer overflows

  - CAN-2004-1009

    One infinite loop vulnerability

  - CAN-2004-1090

    Denial of service via corrupted section header

  - CAN-2004-1091

    Denial of service via null dereference

  - CAN-2004-1092

    Freeing unallocated memory

  - CAN-2004-1093

    Denial of service via use of already freed memory

  - CAN-2004-1174

    Denial of service via manipulating non-existing file     handles

  - CAN-2004-1175

    Unintended program execution via insecure filename     quoting

  - CAN-2004-1176

    Denial of service via a buffer underflow

ID	Name	Product	Family	Severity
41343	SuSE9 Security Update : Midnight Commander (YOU Patch Number 9797)	Nessus	SuSE Local Security Checks	high
17267	RHEL 2.1 : mc (RHSA-2005:217)	Nessus	Red Hat Local Security Checks	high
17138	GLSA-200502-24 : Midnight Commander: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
16165	Debian DSA-639-1 : mc - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2004-1176

critical

Tenable Plugins

high

high

high

high