Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: Apps A-M :: mc9.htm

Midnight Commander 4.5.51 directory bug

    Midnight Commander


    Midnight Commander 4.5.51


    Michal Zalewski found following.

        $ od -t x1 mcbug
        0000000 03 14 77 04 0a
        $ mkdir `cat mcbug`
        $ mc

    (try to view this directory - 'w' - 0x77 command will be executed;
    longer commands might be used, as well)

    Obviously,  this  attack  requires  privledged  user  interaction.
    Midnight Commander  won't display  full name  of the  directory if
    it's  long  enough,  so  these  control  characters  can be easily

    Such problems in Midnight Commander  seems to appear less or  more
    frequently.  We are affraid  that this pretty useful file  manager
    should not be used in multiuser systems, especially by root.


    Workaround: well, only a code audit might help.

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH