Updated mc packages are available for Red Hat Linux 7.3/9 and Fedora Core 1/2
---------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated mc packages fix security issues
Advisory ID: FLSA:152889
Issue date: 2005-08-10
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
CVE Names: CAN-2004-0226 CAN-2004-0231 CAN-2004-0232
CAN-2004-0494 CAN-2004-1004 CAN-2004-1005
CAN-2004-1009 CAN-2004-1090 CAN-2004-1091
CAN-2004-1092 CAN-2004-1093 CAN-2004-1174
CAN-2004-1175 CAN-2004-1176 CAN-2005-0763
---------------------------------------------------------------------
---------------------------------------------------------------------
1. Topic:
Updated mc packages that fix several security issues are now available.
Midnight Commander is a visual shell much like a file manager.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386
3. Problem description:
Several buffer overflows, several temporary file creation vulnerabilities, and one format string vulnerability have been discovered in Midnight Commander. These vulnerabilities were discovered mostly by Andrew V. Samoilov and Pavel Roskin. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0226, CAN-2004-0231, and CAN-2004-0232 to these issues.
Shell escape bugs have been discovered in several of the mc vfs backend scripts. An attacker who is able to influence a victim to open a specially-crafted URI using mc could execute arbitrary commands as the victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0494 to this issue.
Several format string bugs were found in Midnight Commander. If a user is tricked by an attacker into opening a specially crafted path with mc, it may be possible to execute arbitrary code as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1004 to this issue.
Several buffer overflow bugs were found in Midnight Commander. If a user is tricked by an attacker into opening a specially crafted file or path with mc, it may be possible to execute arbitrary code as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1005 to this issue.
Several denial of service bugs were found in Midnight Commander. These bugs could cause Midnight Commander to hang or crash if a victim opens a carefully crafted file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-1009, CAN-2004-1090, CAN-2004-1091, CAN-2004-1092, CAN-2004-1093 and CAN-2004-1174 to these issues.
A filename quoting bug was found in Midnight Commander's FISH protocol handler. If a victim connects via embedded SSH support to a host containing a carefully crafted filename, arbitrary code may be executed as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1175 to this issue.
A buffer underflow bug was found in Midnight Commander. If a malicious local user is able to modify the extfs.ini file, it could be possible to execute arbitrary code as a user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1176 to this issue.
A buffer overflow bug was found in the way Midnight Commander handles directory completion. If a victim uses completion on a maliciously crafted directory path, it is possible for arbitrary code to be executed as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0763 to this issue.
Users of mc are advised to upgrade to these packages, which contain backported security patches to correct these issues.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.
Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get.
5. Bug IDs fixed:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152889
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mc-4.5.55-12.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mc-4.5.55-12.legacy.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/mc-4.6.0-18.3.fc0.9.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/mc-4.6.0-18.3.fc0.9.legacy.i386.rpm
Fedora Core 1:
SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/mc-4.6.0-18.3.fc1.0.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/mc-4.6.0-18.3.fc1.0.legacy.i386.rpm
Fedora Core 2:
SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/mc-4.6.1-0.13.FC2.1.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/mc-4.6.1-0.13.FC2.1.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
---------------------------------------------------------------------
7dd653902f620c9ab66fc187c92e1e8c70af4b6f
redhat/7.3/updates/i386/mc-4.5.55-12.legacy.i386.rpm
94c75a0b0dcb60dd1df86b247af305b876d9a1e8
redhat/7.3/updates/SRPMS/mc-4.5.55-12.legacy.src.rpm
82c7263b65d3959003c6043131dad7248fa7c40e
redhat/9/updates/i386/mc-4.6.0-18.3.fc0.9.legacy.i386.rpm
df1385e379c96a306acfd106533cc2195b4ea39a
redhat/9/updates/SRPMS/mc-4.6.0-18.3.fc0.9.legacy.src.rpm
14ba4a2f6f2096786ffc543f5e084ad1d69b3f1b
fedora/1/updates/i386/mc-4.6.0-18.3.fc1.0.legacy.i386.rpm
c17b32b79eba441aaf458036ac7dfa08d77c4bb7
fedora/1/updates/SRPMS/mc-4.6.0-18.3.fc1.0.legacy.src.rpm
a8270921b5ded8b829c7fda54d7bac77145df129
fedora/2/updates/i386/mc-4.6.1-0.13.FC2.1.legacy.i386.rpm
30c732c47fb2c97743b492b0c41d8cfc4ff28b96
fedora/2/updates/SRPMS/mc-4.6.1-0.13.FC2.1.legacy.src.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0226
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0231
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1004
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1009
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1091
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1092
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1093
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1176
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0763
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org
---------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated mc packages fix security issues
Advisory ID: FLSA:152889
Issue date: 2005-08-10
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
CVE Names: CAN-2004-0226 CAN-2004-0231 CAN-2004-0232
CAN-2004-0494 CAN-2004-1004 CAN-2004-1005
CAN-2004-1009 CAN-2004-1090 CAN-2004-1091
CAN-2004-1092 CAN-2004-1093 CAN-2004-1174
CAN-2004-1175 CAN-2004-1176 CAN-2005-0763
---------------------------------------------------------------------
---------------------------------------------------------------------
1. Topic:
Updated mc packages that fix several security issues are now available.
Midnight Commander is a visual shell much like a file manager.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386
3. Problem description:
Several buffer overflows, several temporary file creation vulnerabilities, and one format string vulnerability have been discovered in Midnight Commander. These vulnerabilities were discovered mostly by Andrew V. Samoilov and Pavel Roskin. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-0226, CAN-2004-0231, and CAN-2004-0232 to these issues.
Shell escape bugs have been discovered in several of the mc vfs backend scripts. An attacker who is able to influence a victim to open a specially-crafted URI using mc could execute arbitrary commands as the victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0494 to this issue.
Several format string bugs were found in Midnight Commander. If a user is tricked by an attacker into opening a specially crafted path with mc, it may be possible to execute arbitrary code as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1004 to this issue.
Several buffer overflow bugs were found in Midnight Commander. If a user is tricked by an attacker into opening a specially crafted file or path with mc, it may be possible to execute arbitrary code as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1005 to this issue.
Several denial of service bugs were found in Midnight Commander. These bugs could cause Midnight Commander to hang or crash if a victim opens a carefully crafted file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2004-1009, CAN-2004-1090, CAN-2004-1091, CAN-2004-1092, CAN-2004-1093 and CAN-2004-1174 to these issues.
A filename quoting bug was found in Midnight Commander's FISH protocol handler. If a victim connects via embedded SSH support to a host containing a carefully crafted filename, arbitrary code may be executed as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1175 to this issue.
A buffer underflow bug was found in Midnight Commander. If a malicious local user is able to modify the extfs.ini file, it could be possible to execute arbitrary code as a user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1176 to this issue.
A buffer overflow bug was found in the way Midnight Commander handles directory completion. If a victim uses completion on a maliciously crafted directory path, it is possible for arbitrary code to be executed as the user running Midnight Commander. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0763 to this issue.
Users of mc are advised to upgrade to these packages, which contain backported security patches to correct these issues.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.
Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get.
5. Bug IDs fixed:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152889
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mc-4.5.55-12.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mc-4.5.55-12.legacy.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/mc-4.6.0-18.3.fc0.9.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/mc-4.6.0-18.3.fc0.9.legacy.i386.rpm
Fedora Core 1:
SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/mc-4.6.0-18.3.fc1.0.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/mc-4.6.0-18.3.fc1.0.legacy.i386.rpm
Fedora Core 2:
SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/mc-4.6.1-0.13.FC2.1.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/mc-4.6.1-0.13.FC2.1.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
---------------------------------------------------------------------
7dd653902f620c9ab66fc187c92e1e8c70af4b6f
redhat/7.3/updates/i386/mc-4.5.55-12.legacy.i386.rpm
94c75a0b0dcb60dd1df86b247af305b876d9a1e8
redhat/7.3/updates/SRPMS/mc-4.5.55-12.legacy.src.rpm
82c7263b65d3959003c6043131dad7248fa7c40e
redhat/9/updates/i386/mc-4.6.0-18.3.fc0.9.legacy.i386.rpm
df1385e379c96a306acfd106533cc2195b4ea39a
redhat/9/updates/SRPMS/mc-4.6.0-18.3.fc0.9.legacy.src.rpm
14ba4a2f6f2096786ffc543f5e084ad1d69b3f1b
fedora/1/updates/i386/mc-4.6.0-18.3.fc1.0.legacy.i386.rpm
c17b32b79eba441aaf458036ac7dfa08d77c4bb7
fedora/1/updates/SRPMS/mc-4.6.0-18.3.fc1.0.legacy.src.rpm
a8270921b5ded8b829c7fda54d7bac77145df129
fedora/2/updates/i386/mc-4.6.1-0.13.FC2.1.legacy.i386.rpm
30c732c47fb2c97743b492b0c41d8cfc4ff28b96
fedora/2/updates/SRPMS/mc-4.6.1-0.13.FC2.1.legacy.src.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0226
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0231
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1004
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1009
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1091
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1092
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1093
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1176
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0763
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org
