Midnight Commander Virtual File System Symlink Buffer Overflow Vulnerability

BID:8658

Info

Midnight Commander Virtual File System Symlink Buffer Overflow Vulnerability

Bugtraq ID: 8658
Class: Boundary Condition Error
CVE: CVE-2003-1023
Remote: Yes
Local: No
Published: Sep 19 2003 12:00AM
Updated: Jul 11 2009 11:56PM
Credit: Discovery of this vulnerability has been credited to Ilya Teterin <[email protected]>.
Vulnerable: SGI ProPack 2.4
SGI ProPack 2.3
Midnight Commander Midnight Commander 4.6
+ OpenPKG OpenPKG 2.0
+ OpenPKG OpenPKG 1.3
+ OpenPKG OpenPKG Current
 + Redhat Enterprise Linux AS 3
 + Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 3
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 3
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1
 + Redhat Fedora Core1
 + Redhat Linux 9.0 i386
 + S.u.S.E. Linux Personal 9.0
+ S.u.S.E. Linux Personal 8.2
Midnight Commander Midnight Commander 4.5.55
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ Mandriva Linux Mandrake 9.2 amd64
 + Mandriva Linux Mandrake 9.2
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
+ Mandriva Linux Mandrake 9.0
+ SuSE Linux 8.1
+ SuSE Linux 8.0
Midnight Commander Midnight Commander 4.5.52
Midnight Commander Midnight Commander 4.5.51
+ SCO OpenLinux Server 3.1.1
+ SCO OpenLinux Workstation 3.1.1
Gentoo Linux 1.4 _rc3
Gentoo Linux 1.4 _rc2
Gentoo Linux 1.4 _rc1
Gentoo Linux 1.4
Gentoo Linux 1.2
Gentoo Linux 1.1 a
Gentoo Linux 0.7
Gentoo Linux 0.5
Not Vulnerable:

Solution / Fix

Midnight Commander Virtual File System Symlink Buffer Overflow Vulnerability

Solution:
SGI has released an advisory 20040202-01-U to address this and other issues in SGI ProPack 2.4. Please see the referenced advisory for more information. Fixes are available below.

Debian has released an advisory (DSA 424-1) to address this issue. Please see referenced advisory for further details regarding the application of relevant fixes.

Red Hat has released advisory RHSA-2004:034-01 to address this issue.

Mandrake has released an advisory (MDKSA-2004:007) that includes updates for this issue.

RedHat Fedora has released advisory FEDORA-2004-058 to address this issue.

SGI has released an advisory 20040201-01-U with a patch to address this and other issues. Please see the referenced advisory for more information.

SCO Openlinux advisory CSSA-2004-014.0 advisory has been released dealing with this issue.

Gentoo has released advisory GLSA 200403-09 to address this issue. To
update the system, enter the following commands:
# emerge sync

# emerge -pv ">=app-misc/mc-4.6.0-r5"
# emerge ">=app-misc/mc-4.6.0-r5"

Conectiva has released advisory CLA-2004:833 and fixes to address this issue.

OpenPKG has released advisory OpenPKG-SA-2004.009 to address this issue.

Red Hat Fedora Legacy has released advisory FLSA:1224 dealing with this issue for Red Hat Linux 8.0, 7.3 and 7.2. Please see the referenced advisory for more information.

Fixes:


SGI ProPack 2.3

SGI ProPack 2.4

Midnight Commander Midnight Commander 4.5.51

Midnight Commander Midnight Commander 4.5.55

Midnight Commander Midnight Commander 4.6

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report