PT-2021-5783 · Unknown+6 · Midnight Commander+5

Manfred Kaiser · Published 2021-07-09 · Updated 2024-06-15 · CVE-2021-36370

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Midnight Commander versions through 4.8.26

Description The issue is related to the lack of server fingerprint checking and display in Midnight Commander. This allows a remote attacker to potentially compromise data integrity by connecting to a server without verifying its authenticity. When establishing an SFTP connection, the server's fingerprint is neither checked nor displayed, resulting in the user being unable to verify the server's authenticity.

Recommendations For Midnight Commander versions through 4.8.26, consider disabling SFTP connections until a patch is available to address the lack of server fingerprint verification. As a temporary workaround, users should manually verify the server's authenticity before establishing a connection.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2022-1011

ALT-PU-2022-1068

ALT-PU-2022-1089

ALT-PU-2022-1102

AZL-6678

BDU:2022-00235

CVE-2021-36370

MGASA-2022-0086

OESA-2022-1771

OPENSUSE-SU-2022:0061-1

OPENSUSE-SU-2024:11580-1

USN-5160-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Midnight Commander

Ubuntu

References · 35

• 🔥 https://github.com/MidnightCommander/mc/blob/5c1d3c55dd15356ec7d079084d904b7b0fd58d3e/src/vfs/sftpfs/connection.c#L484 · Exploit
• 🔥 https://github.com/MidnightCommander/mc/blob/master/src/vfs/sftpfs/connection.c · Exploit
• 🔥 https://docs.ssh-mitm.at/CVE-2021-36370.html · Exploit
• https://osv.dev/vulnerability/MGASA-2022-0086 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36370 · Security Note
• https://midnight-commander.org · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:0061-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36370 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5160-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36370 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0086.html · Security Note
• https://bdu.fstec.ru/vul/2022-00235 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1771 · Vendor Advisory