An incomplete fix for an issue related to the Lynx URL handler might allow for the remote execution of arbitrary commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-client/lynx | * | < 2.8.6-r4 | >= 2.8.6-r4 |
Lynx is a fully-featured WWW client for users running cursor-addressable, character-cell display devices such as vt100 terminals and terminal emulators.
Clint Ruoho reported that the fix for CVE-2005-2929 (GLSA 200511-09) only disabled the lynxcgi:// handler when not using the advanced mode.
A remote attacker can entice a user to access a malicious HTTP server, causing Lynx to execute arbitrary commands. NOTE: The advanced mode is not enabled by default. Successful exploitation requires the "lynxcgi://" protocol to be registered with lynx on the victim's system.
There is no known workaround at this time.
All Lynx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/lynx-2.8.6-r4"
Lynx is vulnerable to an issue which allows the remote execution of arbitrary commands.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-client/lynx | * | < 2.8.5-r2 | >= 2.8.5-r2 |
Lynx is a fully-featured WWW client for users running cursor-addressable, character-cell display devices such as vt100 terminals and terminal emulators.
iDefense labs discovered a problem within the feature to execute local cgi-bin programs via the "lynxcgi:" URI handler. Due to a configuration error, the default settings allow websites to specify commands to run as the user running Lynx.
A remote attacker can entice a user to access a malicious HTTP server, causing Lynx to execute arbitrary commands.
Disable "lynxcgi" links by specifying the following directive in lynx.cfg:
TRUSTED_LYNXCGI:none
All Lynx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/lynx-2.8.5-r2"
Lynx contains a buffer overflow that may be exploited to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-client/lynx | * | < 2.8.5-r1 | >= 2.8.5-r1 |
Lynx is a text-mode browser for the World Wide Web. It supports multiple URL types, including HTTP and NNTP URLs.
When accessing a NNTP URL, Lynx connects to a NNTP server and retrieves information about the available articles in the target newsgroup. Ulf Harnhammar discovered a buffer overflow in a function that handles the escaping of special characters.
An attacker could setup a malicious NNTP server and entice a user to access it using Lynx (either by creating NNTP links on a web page or by forcing a redirect for Lynx users). The data returned by the NNTP server would trigger the buffer overflow and execute arbitrary code with the rights of the user running Lynx.
There is no known workaround at this time.
All Lynx users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/lynx-2.8.5-r1"