SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Lynx Vendors:   [Multiple Authors/Vendors]
Lynx 'lynxcgt:' Handler Configuration Bug Lets Remote Users Execute Arbitrary Commands
SecurityTracker Alert ID:  1015195
SecurityTracker URL:  http://securitytracker.com/id/1015195
CVE Reference:   CVE-2005-2929   (Links to External Site)
Date:  Nov 11 2005
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.8.5 and prior versions
Description:   iDEFENSE reported a vulnerability in Lynx. A remote user can cause arbitrary commands to be executed on the target user's system.

A remote user can create a specially crafted link, when loaded by the target user, will invoke the 'lynxcgi:' handler and execute arbitrary commands. The commands will run with the privileges of the target user.

The 'lynxexec' and 'lynxprog' handlers are also affected.

The vendor was notified on October 27, 2005.

The original advisory is available at:

http://www.idefense.com/application/poi/display?id=338&type=vulnerabilities

Impact:   A remote user can cause arbitrary commands to be executed on the target user's system with the privileges of the target user.
Solution:   The vendor has issued a fixed version (2.8.6dev.15), available at:

http://lynx.isc.org/current/index.html

A patch is also available at:

http://lynx.isc.org/current/2.8.6dev.15.patch.gz

Vendor URL:  lynx.isc.org/ (Links to External Site)
Cause:   Configuration error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Nov 12 2005 (Red Hat Issues Fix) Lynx 'lynxcgt:' Handler Configuration Bug Lets Remote Users Execute Arbitrary Commands
Red Hat has released a fix for Red Hat Enterprise Linux 2.1, 3, and 4.



 Source Message Contents

Subject:  iDefense Security Advisory 11.11.05: Multiple Vendor Lynx Command

Multiple Vendor Lynx Command Injection Vulnerability

iDefense Security Advisory 11.11.05
www.idefense.com/application/poi/display?id=338&type=vulnerabilities
November 11, 2005

I. BACKGROUND

Lynx is a fully-featured WWW client for users running cursor-
addressable, character-cell display devices such as vt100 terminals and
terminal emulators. Lynx support a number of protocols including HTTP,
HTTPS, gopher, FTP, WAIS, NNTP, finger or cso/ph/qi servers, and
services accessible via logons to telnet, tn3270 or rlogin accounts.

II. DESCRIPTION

Remote exploitation of a command injection vulnerability in various
vendors' implementations of Lynx could allow attackers to execute
arbitrary commands with the privileges of the underlying user.

The problem specifically exists within the feature to execute local
cgi-bin programs via the "lynxcgi:" URI handler. The handler is
generally intended to be restricted to a specific directory or
program(s). However, due to a configuration error on multiple platforms,
the default settings allow for arbitrary websites to specify commands to
run as the user running Lynx.

III. ANALYSIS

Successful exploitation of the described vulnerability allows remote
attackers to execute arbitrary commands with the privileges of the
underlying user. Exploitation requires that an attacker convince a
target user to follow a malicious link from within a vulnerable version
of Lynx. The "lynxexec" and "lynxprog" URI handlers can also be used to
trigger the issue. However, they are rarely compiled into the Lynx
binary.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability in the latest
stable release of Lynx, version 2.8.5. It is suspected that earlier
versions are also affected. The following vendors include susceptible
Lynx packages within their respective distributions:

   * Red Hat Inc.
   * Gentoo Foundation Inc.
   * Mandriva SA

Other vendors are suspected as also being vulnerable. The following
vendors include Lynx packages that are not susceptible to exploitation
as the "lynxcgi" feature is not compiled into Lynx by default:

   * The FreeBSD Project
   * OpenBSD

V. WORKAROUND

Disable "lynxcgi" links by specifying the following directive in
lynx.cfg:

   TRUSTED_LYNXCGI:none

VI. VENDOR RESPONSE

Development version 2.8.6dev.15 has been released to address this issue
and is available from the following URLs:

 http://lynx.isc.org/current/lynx2.8.6dev.15.tar.Z
 http://lynx.isc.org/current/lynx2.8.6dev.15.tar.bz2
 http://lynx.isc.org/current/lynx2.8.6dev.15.tar.gz
 http://lynx.isc.org/current/lynx2.8.6dev.15.zip

Alternately, an incremental patch is available at:

 http://lynx.isc.org/current/2.8.6dev.15.patch.gz

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2005-2929 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

10/27/2005  Initial vendor notification
10/28/2005  Initial vendor response
11/11/2005  Public disclosure

IX. CREDIT

vade79 (http://fakehalo.us) is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

Free tools, research and upcoming events
http://labs.idefense.com

X. LEGAL NOTICES


Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC