Lynx 'lynxcgt:' Handler Configuration Bug Lets Remote Users Execute Arbitrary Commands
SecurityTracker Alert ID: 1015195|
SecurityTracker URL: http://securitytracker.com/id/1015195
(Links to External Site)
Date: Nov 11 2005
Execution of arbitrary code via network, User access via network|
Fix Available: Yes Vendor Confirmed: Yes |
Version(s): 2.8.5 and prior versions|
iDEFENSE reported a vulnerability in Lynx. A remote user can cause arbitrary commands to be executed on the target user's system.|
A remote user can create a specially crafted link, when loaded by the target user, will invoke the 'lynxcgi:' handler and execute arbitrary commands. The commands will run with the privileges of the target user.
The 'lynxexec' and 'lynxprog' handlers are also affected.
The vendor was notified on October 27, 2005.
The original advisory is available at:
A remote user can cause arbitrary commands to be executed on the target user's system with the privileges of the target user.|
The vendor has issued a fixed version (2.8.6dev.15), available at:|
A patch is also available at:
Vendor URL: lynx.isc.org/ (Links to External Site)
|Underlying OS: Linux (Any), UNIX (Any), Windows (Any)|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Subject: iDefense Security Advisory 11.11.05: Multiple Vendor Lynx Command|
Multiple Vendor Lynx Command Injection Vulnerability
iDefense Security Advisory 11.11.05
November 11, 2005
Lynx is a fully-featured WWW client for users running cursor-
addressable, character-cell display devices such as vt100 terminals and
terminal emulators. Lynx support a number of protocols including HTTP,
HTTPS, gopher, FTP, WAIS, NNTP, finger or cso/ph/qi servers, and
services accessible via logons to telnet, tn3270 or rlogin accounts.
Remote exploitation of a command injection vulnerability in various
vendors' implementations of Lynx could allow attackers to execute
arbitrary commands with the privileges of the underlying user.
The problem specifically exists within the feature to execute local
cgi-bin programs via the "lynxcgi:" URI handler. The handler is
generally intended to be restricted to a specific directory or
program(s). However, due to a configuration error on multiple platforms,
the default settings allow for arbitrary websites to specify commands to
run as the user running Lynx.
Successful exploitation of the described vulnerability allows remote
attackers to execute arbitrary commands with the privileges of the
underlying user. Exploitation requires that an attacker convince a
target user to follow a malicious link from within a vulnerable version
of Lynx. The "lynxexec" and "lynxprog" URI handlers can also be used to
trigger the issue. However, they are rarely compiled into the Lynx
iDEFENSE has confirmed the existence of this vulnerability in the latest
stable release of Lynx, version 2.8.5. It is suspected that earlier
versions are also affected. The following vendors include susceptible
Lynx packages within their respective distributions:
* Red Hat Inc.
* Gentoo Foundation Inc.
* Mandriva SA
Other vendors are suspected as also being vulnerable. The following
vendors include Lynx packages that are not susceptible to exploitation
as the "lynxcgi" feature is not compiled into Lynx by default:
* The FreeBSD Project
Disable "lynxcgi" links by specifying the following directive in
VI. VENDOR RESPONSE
Development version 2.8.6dev.15 has been released to address this issue
and is available from the following URLs:
Alternately, an incremental patch is available at:
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2005-2929 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
VIII. DISCLOSURE TIMELINE
10/27/2005 Initial vendor notification
10/28/2005 Initial vendor response
11/11/2005 Public disclosure
vade79 (http://fakehalo.us) is credited with this discovery.
Get paid for vulnerability research
Free tools, research and upcoming events
X. LEGAL NOTICES
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email firstname.lastname@example.org for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,