Message-ID: <42FA9254.2000107@videotron.ca>
Date: Wed, 10 Aug 2005 19:48:36 -0400
From: Marc Deslauriers <marcdeslauriers@...eotron.ca>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [FLSA-2005:152889] Updated mc packages fix
	security issues

---------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated mc packages fix security issues
Advisory ID:       FLSA:152889
Issue date:        2005-08-10
Product:           Red Hat Linux, Fedora Core
Keywords:          Bugfix
CVE Names:         CAN-2004-0226 CAN-2004-0231 CAN-2004-0232
                   CAN-2004-0494 CAN-2004-1004 CAN-2004-1005
                   CAN-2004-1009 CAN-2004-1090 CAN-2004-1091
                   CAN-2004-1092 CAN-2004-1093 CAN-2004-1174
                   CAN-2004-1175 CAN-2004-1176 CAN-2005-0763
---------------------------------------------------------------------


---------------------------------------------------------------------
1. Topic:

Updated mc packages that fix several security issues are now available.

Midnight Commander is a visual shell much like a file manager.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386

3. Problem description:

Several buffer overflows, several temporary file creation
vulnerabilities, and one format string vulnerability have been
discovered in Midnight Commander. These vulnerabilities were discovered
mostly by Andrew V. Samoilov and Pavel Roskin. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
names CAN-2004-0226, CAN-2004-0231, and CAN-2004-0232 to these issues.

Shell escape bugs have been discovered in several of the mc vfs backend
scripts. An attacker who is able to influence a victim to open a
specially-crafted URI using mc could execute arbitrary commands as the
victim. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0494 to this issue.

Several format string bugs were found in Midnight Commander. If a user
is tricked by an attacker into opening a specially crafted path with mc,
it may be possible to execute arbitrary code as the user running
Midnight Commander. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-1004 to this issue.

Several buffer overflow bugs were found in Midnight Commander. If a user
is tricked by an attacker into opening a specially crafted file or path
with mc, it may be possible to execute arbitrary code as the user
running Midnight Commander. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-1005 to this
issue.

Several denial of service bugs were found in Midnight Commander. These
bugs could cause Midnight Commander to hang or crash if a victim opens a
carefully crafted file. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the names CAN-2004-1009, CAN-2004-1090,
CAN-2004-1091, CAN-2004-1092, CAN-2004-1093 and CAN-2004-1174 to these
issues.

A filename quoting bug was found in Midnight Commander's FISH protocol
handler. If a victim connects via embedded SSH support to a host
containing a carefully crafted filename, arbitrary code may be executed
as the user running Midnight Commander. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-1175 to
this issue.

A buffer underflow bug was found in Midnight Commander. If a malicious
local user is able to modify the extfs.ini file, it could be possible to
execute arbitrary code as a user running Midnight Commander. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-1176 to this issue.

A buffer overflow bug was found in the way Midnight Commander handles
directory completion. If a victim uses completion on a maliciously
crafted directory path, it is possible for arbitrary code to be executed
as the user running Midnight Commander. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0763 to
this issue.

Users of mc are advised to upgrade to these packages, which contain
backported security patches to correct these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which
are not installed but included in the list will not be updated.  Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.  This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152889

6. RPMs required:

Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/mc-4.5.55-12.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/mc-4.5.55-12.legacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/mc-4.6.0-18.3.fc0.9.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/mc-4.6.0-18.3.fc0.9.legacy.i386.rpm

Fedora Core 1:

SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/mc-4.6.0-18.3.fc1.0.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/mc-4.6.0-18.3.fc1.0.legacy.i386.rpm

Fedora Core 2:

SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/mc-4.6.1-0.13.FC2.1.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/mc-4.6.1-0.13.FC2.1.legacy.i386.rpm


7. Verification:

SHA1 sum                                 Package Name
---------------------------------------------------------------------

7dd653902f620c9ab66fc187c92e1e8c70af4b6f
redhat/7.3/updates/i386/mc-4.5.55-12.legacy.i386.rpm
94c75a0b0dcb60dd1df86b247af305b876d9a1e8
redhat/7.3/updates/SRPMS/mc-4.5.55-12.legacy.src.rpm
82c7263b65d3959003c6043131dad7248fa7c40e
redhat/9/updates/i386/mc-4.6.0-18.3.fc0.9.legacy.i386.rpm
df1385e379c96a306acfd106533cc2195b4ea39a
redhat/9/updates/SRPMS/mc-4.6.0-18.3.fc0.9.legacy.src.rpm
14ba4a2f6f2096786ffc543f5e084ad1d69b3f1b
fedora/1/updates/i386/mc-4.6.0-18.3.fc1.0.legacy.i386.rpm
c17b32b79eba441aaf458036ac7dfa08d77c4bb7
fedora/1/updates/SRPMS/mc-4.6.0-18.3.fc1.0.legacy.src.rpm
a8270921b5ded8b829c7fda54d7bac77145df129
fedora/2/updates/i386/mc-4.6.1-0.13.FC2.1.legacy.i386.rpm
30c732c47fb2c97743b492b0c41d8cfc4ff28b96
fedora/2/updates/SRPMS/mc-4.6.1-0.13.FC2.1.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0226
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0231
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0232
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1004
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1009
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1090
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1091
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1092
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1093
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1176
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0763

9. Contact:

The Fedora Legacy security contact is <secnotice@...oralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists