[SECURITY] [DSA 424-1] New mc packages fix buffer overflow

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 424-1 [email protected] http://www.debian.org/security/ Matt Zimmerman January 16th, 2004 http://www.debian.org/security/faq -...

Midnight Commander buffer overflow

Buffer overflow on archives processing...

[SECURITY] [DSA 424-1] New mc packages fix buffer overflow

-------------------------------------------------------------------------- Debian Security Advisory DSA 424-1 [email protected] http://www.debian.org/security/ Matt Zimmerman January 16th, 2004 http://www.debian.org/security/faq -...

DSA-424 mc - buffer overflow

Bulletin has no description...

CVE-2003-1023

Stack-based buffer overflow in vfssresolvesymlink of vfs/direntry.c for Midnight Commander mc 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion...

CVE-2003-1023

Stack-based buffer overflow in vfssresolvesymlink of vfs/direntry.c for Midnight Commander mc 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion...

CVE-2003-1023

CVE-2003-1023 affects Midnight Commander (mc) 4.6.0 and earlier. It is a stack-based buffer overflow in vfs_s_resolve_symlink (vfs/direntry.c) that could allow a remote attacker to execute arbitrary code during symlink conversion. The issue is documented in multiple advisories (e.g., Debian DSA-4...

Midnight commander buffer overflow

Uninitialized buffer data triggers buffer overflow during archive listing...

uninitialized buffer in midnight commander

Midnight Commander is using uninitialized buffer for handling symlinks in VFS tar, cpio. See vfs/direntry.c, handling of buf at vfssresolvesymlink. I wonder but it works almost properly ;- On linux-i386 I can reach stack buffer overflow using specially crafted archive. Open...

Midnight Commander buffer overflow during symlink resolution

Midnight Commander uses a fixed sized stack buffer while resolving symbolic links within file archives tar or cpio. If an attacker can cause a user to process a specially crafted file archive with Midnight Commander, the attacker may be able to obtain the privileges of the target user...

CVE-1999-1337

FTP client in Midnight Commander mc before 4.5.11 stores usernames and passwords for visited sites in plaintext in the world-readable history file, which allows other local users to gain privileges...

CVE-1999-1337

CVE-1999-1337 affects Midnight Commander (mc) before 4.5.11. The FTP client stores visited-site usernames/passwords in plaintext in the world-readable history file, enabling local users to gain partial privileges. Root cause: insecure plaintext history storage. Impact: local privilege elevation/p...

Buffer-overflow vulnerability in Midnight Commander

Overview The mcedit component of some versions of Midnight Commander contains a buffer-overflow vulnerability. Description Midnight Commander is a file manager for open source operating systems, distributed under the GNU General Public License GPL. In version 4.5.1 of Midnight Commander, the mced...

CVE-2001-1429

Buffer overflow in mcedit in Midnight Commander 4.5.1 allows local users to cause a denial of service segmentation fault and possibly execute arbitrary code via a crafted text file...

CVE-2000-1108

CVE-2000-1108 affects Midnight Commander (mc) cons.saver for 4.x and earlier. Root cause: cons.saver does not properly verify if the output descriptor is a TTY and mishandles the argument as a TTY, allowing a local user to cause file corruption by abusing a symlink to the target file when mc is i...

CVE-2000-1109

Midnight Commander mc 4.5.51 and earlier does not properly process malformed directory names when a user opens a directory, which allows other local users to gain privileges by creating directories that contain special characters followed by the commands to be executed...

CVE-2000-1108

cons.saver in Midnight Commander mc 4.5.42 and earlier does not properly verify if an output file descriptor is a TTY, which allows local users to corrupt files by creating a symbolic link to the target file, calling mc, and specifying that link as a TTY argument...

CVE-2000-1109

CVE-2000-1109 affects Midnight Commander (mc) versions up to 4.x, specifically 4.5.51 and earlier. The issue arises when mc processes malformed directory names during directory opening, allowing a local user to gain privileges by creating directories that contain special characters followed by co...

[SECURITY] [DSA 036-1] New version of Midnight Commander available

---------------------------------------------------------------------------- Debian Security Advisory DSA-036-1 [email protected] http://www.debian.org/security/ Martin Schulze March 7, 2001 - ---------------------------------------------------------------------------- Package : mc...

CVE-2000-1109

Midnight Commander mc 4.5.51 and earlier does not properly process malformed directory names when a user opens a directory, which allows other local users to gain privileges by creating directories that contain special characters followed by the commands to be executed...