Lynx: Arbitrary command execution

Lynx: Arbitrary command execution An incomplete fix for an issue related to the Lynx URL handler might allow for the remote execution of arbitrary commands. lynx September 12, 2009 September 12, 2009: 01 243058 remote 2.8.6-r4 2.8.6-r4

Lynx is a fully-featured WWW client for users running cursor-addressable, character-cell display devices such as vt100 terminals and terminal emulators.

Clint Ruoho reported that the fix for CVE-2005-2929 (GLSA 200511-09) only disabled the lynxcgi:// handler when not using the advanced mode.

A remote attacker can entice a user to access a malicious HTTP server, causing Lynx to execute arbitrary commands. NOTE: The advanced mode is not enabled by default. Successful exploitation requires the "lynxcgi://" protocol to be registered with lynx on the victim's system.

There is no known workaround at this time.

All Lynx users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/lynx-2.8.6-r4"

CVE-2005-2929 CVE-2008-4690 GLSA 200511-09 rbu a3li a3li