Thomas,
Thank you for responding. Please let us know how you'd like to proceed.
Michael
-----Original Message-----
From: vendor-disclosure [mailto:[EMAIL PROTECTED]
Sent: Thursday, October 27, 2005 1:53 PM
To: [EMAIL PROTECTED]
Cc: vendor-disclosure
Subject: FW: iDEFENSE Security Advisory [IDEF1089] Multiple Vendor Lynx
Command Injection Vulnerability
The attached advisory and email was originally submitted on 09/08/2005, but
a response has not yet been received. In accordance with our vendor
disclosure policy (http://www.idefense.com/legal_disclosure.jsp) we will
proceed with public disclosure of this issue if acknowledgement of receipt
is not received within five business days.
Regards,
Michael Sutton
Michael Sutton
Director, iDEFENSE Labs
iDEFENSE
1875 Campus Commons Drive, Suite 210
Reston, VA 20191
direct: 703.480.5628
voice: 703.390.1230
fax: 703.390.9456
[EMAIL PROTECTED]
www.idefense.com
-----Original Message-----
From: vendor-disclosure [mailto:[EMAIL PROTECTED]
Sent: Thursday, September 08, 2005 11:50 PM
To: [EMAIL PROTECTED]
Cc: vendor-disclosure
Subject: FW: iDEFENSE Security Advisory [IDEF1089] Multiple Vendor Lynx
Command Injection Vulnerability
The message below bounced.
-----Original Message-----
From: vendor-disclosure [mailto:[EMAIL PROTECTED]
Sent: Thursday, September 08, 2005 11:27 PM
To: [email protected]
Cc: vendor-disclosure
Subject: iDEFENSE Security Advisory [IDEF1089] Multiple Vendor Lynx Command
Injection Vulnerability
iDEFENSE has identified a Command Injection vulnerability in Lynx. This
vulnerability was submitted to iDEFENSE through our Vulnerability
Contributor Program:
http://www.idefense.com/poi/teams/vcp.jsp
iDEFENSE Labs has validated this vulnerability and has drafted the
attached advisory. In accordance with our vendor disclosure policy
http://www.idefense.com/legal_disclosure.jsp
We would request that you acknowledge receipt of this initial
notification within five business days so that we may begin the process
of coordinating an appropriate public disclosure date for this issue
that will provide your company with adequate time to develop a patch or
workaround to mitigate this vulnerability. If you have questions
regarding this issue or require further details to assist with your own
analysis, please do not hesitate to contact us.
It is always our goal to coordinate on the public disclosure of
patches/advisories as quickly as possible after a vulnerability is
discovered. If however a reasonable timeframe cannot be agreed upon for
this issue, it will be publicly released in 60 days on 11/08/2005.
iDEFENSE is willing to work with a vendor to find a mutually agreeable
release date beyond this timeframe so long as the vendor continues to
make good faith efforts to produce patches in a timely fashion and
regularly informs iDEFENSE of their progress in doing so.
Please note that if the affected product is included within other
applications and/or operating systems, iDEFENSE will not be coordinating
disclosure of the vulnerability to affected third parties. We would ask
that you handle this coordination separately.
Regards,
Michael Sutton
Michael Sutton
Director, iDEFENSE Labs
iDEFENSE
1875 Campus Commons Drive, Suite 210
Reston, VA 20191
direct: 703.480.5628
voice: 703.390.1230
fax: 703.390.9456
[EMAIL PROTECTED]
www.idefense.com
Multiple Vendor Lynx Command Injection Vulnerability
iDEFENSE Security Advisory XX.XX.05
www.idefense.com/application/poi/display?type=vulnerabilities
MMM DD, 2005
I. BACKGROUND
Lynx is a fully-featured WWW client for users running cursor-
addressable, character-cell display devices such as vt100 terminals and
terminal emulators. Lynx support a number of protocols including HTTP,
HTTPS, gopher, FTP, WAIS, NNTP, finger or cso/ph/qi servers, and
services accessible via log ons to telnet, tn3270 or rlogin accounts.
II. DESCRIPTION
Remote exploitation of a command injection vulnerability in various
vendors' implementations of Lynx could allow attackers to execute
arbitrary commands with the privileges of the underlying user.
The problem specifically exists within the feature to execute local
cgi-bin programs via the "lynxcgi:" URI handler. The handler is
generally intended to be restricted to a specific directory or
program(s). However, due to a configuration error on multiple platforms,
the default settings allow for arbitrary websites to specify commands to
run as the user running Lynx.
III. ANALYSIS
Successful exploitation of the described vulnerability allows remote
attackers to execute arbitrary commands with the privileges of the
underlying user. Exploitation requires that an attacker convince a
target user to follow a malicious link from within a vulnerable version
of Lynx. The "lynxexec" and "lynxprog" URI handlers can also be used to
trigger the issue. However, they are rarely compiled into the Lynx
binary.
IV. DETECTION
iDEFENSE has confirmed the existence of this vulnerability in the latest
stable release of Lynx, version 2.8.5. It is suspected that earlier
versions are also affected. The following vendors include susceptible
Lynx packages within their respective distributions:
* Red Hat Inc.
* Gentoo Foundation Inc.
* Mandriva SA
Other vendors are suspected as also being vulnerable. The following
vendors include Lynx packages that are not susceptible to exploitation
as the "lynxcgi" feature is not compiled into Lynx by default:
* The FreeBSD Project
* OpenBSD
V. WORKAROUND
Disable "lynxcgi" links by specifying the following directive in
lynx.cfg:
TRUSTED_LYNXCGI:none
VI. VENDOR RESPONSE
[Quoted vendor response if available. Otherwise include vendor fix
details.]
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2005-XXXX to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
[OR]
A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.
VIII. DISCLOSURE TIMELINE
09/08/2005 Initial vendor notification
XX/XX/2005 Initial vendor response
XX/XX/2005 Coordinated public disclosure
IX. CREDIT
vade79 (http://fakehalo.us) is credited with this discovery.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright © 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email [EMAIL PROTECTED] for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information._______________________________________________
Lynx-dev mailing list
[email protected]
http://lists.nongnu.org/mailman/listinfo/lynx-dev
