SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   Midnight Commander Vendors:   GNU Midnight Commander Project
(Slackware Issues Fix) Midnight Commander Has Multiple Bugs That May Let Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1010168
SecurityTracker URL:  http://securitytracker.com/id/1010168
CVE Reference:   CAN-2004-0226, CAN-2004-0231, CAN-2004-0232   (Links to External Site)
Date:  May 17 2004
Impact:   User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Several vulnerabilities were reported in Midnight Commander. A local user may be able to obtain elevated privileges.

Debian and Mandrake reported multiple vulnerabilities in Midnight Commander. The flaws include several buffer overflows [CVE: CAN-2004-0226], a format string vulnerability [CVE: CAN-2004-0232], and a temporary file and directory creation vulnerability [CVE: CAN-2004-0231].

Jacub Jelinek is credited with discovering the flaws.

Impact:   A local user may be able to gain the privileges of the user running mc.
Solution:   Slackware has released a fix.

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mc-4.6.0-i386-2.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mc-4.6.0-i486-2.tgz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mc-4.6.0-i486-2.tgz

The MD5 signatures are:

Slackware 9.0 package:
e74a8dcdd90f2846e4bbac75a154ad39 mc-4.6.0-i386-2.tgz

Slackware 9.1 package:
ac580a4f3556aaae92be0fd754866a55 mc-4.6.0-i486-2.tgz

Slackware -current package:
ce9b9ab338ee114c5d9038e8420db1e7 mc-4.6.0-i486-2.tgz

Vendor URL:  www.ibiblio.org/mc/ (Links to External Site)
Cause:   Access control error, Boundary error, Input validation error, State error
Underlying OS:   Linux (Slackware)

Message History:   This archive entry is a follow-up to the message listed below.
Apr 30 2004 Midnight Commander Has Multiple Bugs That May Let Local Users Gain Elevated Privileges



 Source Message Contents

Date:  Mon, 17 May 2004 02:27:55 -0700 (PDT)
Subject:  [slackware-security] mc (SSA:2004-136-01)



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  mc (SSA:2004-136-01)

New mc packages are available for Slackware 9.0, 9.1, and -current to
fix security issues that These could lead to a denial of service or the
execution of arbitrary code as the user running mc.

Sites that use mc should upgrade to the new mc package.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0226
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0231
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0232

Here are the details from the Slackware 9.1 ChangeLog:
+--------------------------+
Fri May 14 15:11:37 PDT 2004
patches/packages/mc-4.6.0-i486-2.tgz:  Patched to fix buffer overflow,
  format string, and temporary file creation vulnerabilities found by
  Andrew V. Samoilov and Pavel Roskin.  These could lead to a denial of
  service or the execution of arbitrary code as the user running mc.
  For more details, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0226
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0231
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0232
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated package for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mc-4.6.0-i386-2.tgz

Updated package for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/mc-4.6.0-i486-2.tgz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mc-4.6.0-i486-2.tgz


MD5 signatures:
+-------------+

Slackware 9.0 package:
e74a8dcdd90f2846e4bbac75a154ad39  mc-4.6.0-i386-2.tgz

Slackware 9.1 package:
ac580a4f3556aaae92be0fd754866a55  mc-4.6.0-i486-2.tgz

Slackware -current package:
ce9b9ab338ee114c5d9038e8420db1e7  mc-4.6.0-i486-2.tgz


Installation instructions:
+------------------------+

Upgrade the mc package as root:
# upgradepkg mc-4.6.0-i486-2.tgz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAqAviakRjwEAQIjMRAgJ1AJ9K2JdVaoRxaD94OJ4gwkFX2PQV0QCeObkG
/gRKw+TO3RsJ89RRvb7jfcQ=
=EuJI
-----END PGP SIGNATURE-----

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC