PT-2012-5414 · Unknown+1 · Midnight Commander

Jan Lieskovsky · Publicado 2012-10-10 · Atualizado 2017-08-29 · CVE-2012-4463

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Midnight Commander version 4.8.5

Description The issue arises from improper handling of the MC EXT SELECTED or MC EXT ONLYTAGGED environment variables when multiple files are selected. This allows remote attackers to execute arbitrary commands via a crafted file name.

Recommendations For Midnight Commander version 4.8.5, consider avoiding the use of the MC EXT SELECTED and MC EXT ONLYTAGGED environment variables until a patch is available. As a temporary workaround, restrict the selection of files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-4463

Produtos afetados

Midnight Commander

Referências · 14

• https://nvd.nist.gov/vuln/detail/CVE-2012-4463 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2012-4463 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2012-4463 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-4463 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=862813 · Nota
• http://openwall.com/lists/oss-security/2012/10/03/5 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4463 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/10/03/4 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79033 · Nota
• https://bugs.gentoo.org/show_bug.cgi?id=436518#c7 · Nota
• http://securityfocus.com/bid/55777 · Nota
• https://security-tracker.debian.org/tracker/CVE-2012-4463 · Aviso do Fabricante
• https://midnight-commander.org/ticket/2913 · Nota
• https://ubuntu.com/security/CVE-2012-4463 · Aviso do Fabricante