RHSA-2004:464 - Security Advisory
mc security update
Security Advisory: Low
An updated mc package that resolves several shell escape security issues is
[Updated 5 January 2005]
Packages have been updated to include the gmc and mcserv packages which were
left out of the initial errata.
Midnight Commander (mc) is a visual shell much like a file manager.
Shell escape bugs have been discovered in several of the mc vfs backend
scripts. An attacker who is able to influence a victim to open a
specially-crafted URI using mc could execute arbitrary commands as the
victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0494 to this issue.
Users of mc should upgrade to this updated package which contains
backported patches and is not vulnerable to this issue.
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
- Red Hat Enterprise Linux Server 2 ia64
- Red Hat Enterprise Linux Workstation 2 ia64
- Red Hat Enterprise Linux Workstation 2 i386
- BZ - 127974 - CAN-2004-0494 extfs vfs vulnerability in mc
Red Hat Enterprise Linux Server 2
Red Hat Enterprise Linux Workstation 2