PT-2005-1068 · Red Hat+2 · Midnight Commander+1

Published 2005-01-22 · Updated 2022-01-19 · CVE-2004-1174

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions mc versions prior to 4.5.55

Description The issue affects the Midnight Commander package in Red Hat Enterprise Linux, allowing for remote exploitation that can lead to breaches in confidentiality, integrity, and availability of protected information. Specifically, a denial of service can be caused by manipulating non-existing file handles in the direntry.c component of Midnight Commander.

Recommendations For versions prior to 4.5.55, update to a version that includes the fix for the denial of service issue in direntry.c. As a temporary workaround, consider restricting access to the direntry.c component to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2022-1068

ALT-PU-2022-1089

BDU:2015-06202

BDU:2015-06415

BDU:2015-06416

CVE-2004-1174

DSA-639-1

Affected Products

Alt Linux

Midnight Commander

References · 43

• https://security-tracker.debian.org/tracker/CVE-2004-1174 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01363 · Security Note
• http://redhat.com/support/errata/RHSA-2005-512.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0232 · Security Note
• https://errata.altlinux.org/ALT-PU-2022-1068 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1175 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1176 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0226 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1092 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0231 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1004 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-0480 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1009 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1023 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36370 · Security Note