CVE-1999-1337: Medium severity Midnight commander Midnight commander vulnerability
FTP client in Midnight Commander (mc) before 4.5.11 stores usernames and passwords for visited sites in plaintext in the world-readable history file, which allows other local users to gain privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Midnight Commander (mc)to a version that resolves this vulnerability.Fixed in 4.5.11 - Configuration
Remove the world-readable permission on the mc history file so other local users cannot read stored credentials (e.g., change permissions so only the owner can read the file).
Midnight Commander (mc) history file file permissions = remove world-readable / readable only by owner - Operational
Delete or securely wipe the mc history file to remove stored plaintext credentials and rotate any usernames/passwords that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1337?
CVE-1999-1337 is considered a critical vulnerability due to the exposure of sensitive data in plaintext.
How do I fix CVE-1999-1337?
To fix CVE-1999-1337, update the Midnight Commander to version 4.5.12 or later.
What does CVE-1999-1337 affect?
CVE-1999-1337 affects the Midnight Commander FTP client versions prior to 4.5.12.
What risks are associated with CVE-1999-1337?
The risk associated with CVE-1999-1337 is that local users can access stored usernames and passwords, potentially granting unauthorized access.
Is CVE-1999-1337 a local or remote vulnerability?
CVE-1999-1337 is classified as a local vulnerability since it requires local user access to exploit the stored credentials.