CVE-2003-1023 Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code dur...
HighCVSS 7.5
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code during symlink conversion.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| midnight commander | = 4.5.52 | No fix listed |
| midnight commander | = 4.5.55 | No fix listed |
| midnight commander | = 4.6 | No fix listed |
| debian/mc(Debian:12) | < 1:4.6.0-4.6.1-pre1-1 | 1:4.6.0-4.6.1-pre1-1 |
| debian/mc(Debian:13) | < 1:4.6.0-4.6.1-pre1-1 | 1:4.6.0-4.6.1-pre1-1 |
| debian/mc(Debian:14) | < 1:4.6.0-4.6.1-pre1-1 | 1:4.6.0-4.6.1-pre1-1 |
References
- 20030919 uninitialized buffer in midnight commander mailing-list
- CLA-2004:833 vendor-advisory
- FEDORA-2004-058 vendor-advisory
- 20040405 [OpenPKG-SA-2004.009] OpenPKG Security Advisory (mc) mailing-list
- RHSA-2004:034 vendor-advisory
- RHSA-2004:035 vendor-advisory
- 10645 third-party-advisory
- 10685 third-party-advisory
- 10716 third-party-advisory
- 10772 third-party-advisory
- 10823 third-party-advisory
- 11219 third-party-advisory
- 11262 third-party-advisory
- 11268 third-party-advisory
- 11296 third-party-advisory
- 9833 third-party-advisory
- GLSA-200403-09 vendor-advisory
- DSA-424 vendor-advisory
- MDKSA-2004:007 vendor-advisory
- FLSA:1224 vendor-advisory
- 8658 vdb-entry vendor-advisory
- midnight-commander-vfssresolvesymlink-bo(13247) vdb-entry
- oval:org.mitre.oval:def:822 signature vdb-entry
- Debian Security Tracker CVE-2003-1023 vendor-advisory