Published: 10/10/2012 Updated: 29/08/2017

CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9

VMScore: 454

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote malicious users to execute arbitrary commands via a crafted file name.

Vulnerable Product	Search on Vulmon	Subscribe to Product
midnight-commander midnight commander 4.8.5

Debian Bug report logs - #689571 CVE-2012-4463: Improper sanitization of MC_EXT_SELECTED variable when viewing multiple files Package: mc; Maintainer for mc is Dmitry Smirnov <onlyjob@debianorg>; Source for mc is src:mc (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 4 Oct 201 ...

CWE-20 https://bugs.gentoo.org/show_bug.cgi?id=436518#c7 http://www.openwall.com/lists/oss-security/2012/10/03/5 https://bugzilla.redhat.com/show_bug.cgi?id=862813 http://www.openwall.com/lists/oss-security/2012/10/03/4 http://www.securityfocus.com/bid/55777 https://www.midnight-commander.org/ticket/2913 https://exchange.xforce.ibmcloud.com/vulnerabilities/79033 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=689571 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2012-4463

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect