Bug 862813 (CVE-2012-4463)

Summary: CVE-2012-4463 mc: Improper sanitization of MC_EXT_SELECTED variable when viewing multiple files
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: dvlasenk, leonard-rh-bugzilla, pahan, rvokal, slavazanko
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20120928,reported=20120929,source=gentoo,cvss2=5.1/AV:N/AC:H/Au:N/C:P/I:P/A:P,rhel-5/mc=notaffected,rhel-6/mc=notaffected,fedora-all/mc=affected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 862814    
Bug Blocks:    

Description Jan Lieskovsky 2012-10-03 11:29:03 EDT
A security flaw was found in the way Midnight Commander, a user-friendly text console file manager and visual shell, performed sanitization of MC_EXT_SELECTED environment variable when multiple files were selected (first selected file was used as actual content of the MC_EXT_SELECTED variable, while the remaining files were provided as arguments to the temporary script, handling the F3 / Enter key press event). A remote attacker could provide a specially-crafted archive that, when expanded and previewed by the victim could lead to arbitrary code execution with the privileges of the user running mc executable.

References:
[1] https://bugs.gentoo.org/show_bug.cgi?id=436518

Upstream ticket:
[2] https://www.midnight-commander.org/ticket/2913
Comment 1 Jan Lieskovsky 2012-10-03 11:31:06 EDT
This issue did NOT affect the versions of the mc package, as shipped with Red Hat Enterprise Linux 5 and 6.

--

This issue affects the versions of the mc package, as shipped with Fedora release of 16 and 17. Please schedule an update (once there is final upstream patch available).
Comment 2 Jan Lieskovsky 2012-10-03 11:32:08 EDT
Created mc tracking bugs for this issue

Affects: fedora-all [bug 862814]
Comment 3 Jan Lieskovsky 2012-10-03 11:44:11 EDT
CVE Request:
[3] http://www.openwall.com/lists/oss-security/2012/10/03/4
Comment 4 Jan Lieskovsky 2012-10-03 12:48:26 EDT
The CVE identifier of CVE-2012-4463 has been assigned to this issue:
[4] http://www.openwall.com/lists/oss-security/2012/10/03/5
Comment 5 Fedora Update System 2012-12-04 00:21:44 EST
mc-4.8.6-2.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2012-12-06 22:26:54 EST
mc-4.8.6-2.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.