PT-2012-5414 · Unknown+1 · Midnight Commander

Jan Lieskovsky · Published 2012-10-10 · Updated 2017-08-29 · CVE-2012-4463

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Midnight Commander version 4.8.5

Description The issue arises from improper handling of the MC EXT SELECTED or MC EXT ONLYTAGGED environment variables when multiple files are selected. This allows remote attackers to execute arbitrary commands via a crafted file name.

Recommendations For Midnight Commander version 4.8.5, consider avoiding the use of the MC EXT SELECTED and MC EXT ONLYTAGGED environment variables until a patch is available. As a temporary workaround, restrict the selection of files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-4463

Affected Products

Midnight Commander

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2012-4463 · Security Note
• https://osv.dev/vulnerability/CVE-2012-4463 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-4463 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-4463 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4463 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4463 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-4463 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=862813 · Note
• http://openwall.com/lists/oss-security/2012/10/03/5 · Note
• http://openwall.com/lists/oss-security/2012/10/03/4 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79033 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=436518#c7 · Note
• http://securityfocus.com/bid/55777 · Note
• https://midnight-commander.org/ticket/2913 · Note