Sorry, the report should have been attached to the last email. Let me know if it doesn't arrive this time.
I have also attached a PoC exploit. Michael -----Original Message----- From: Thomas Dickey [mailto:[EMAIL PROTECTED] Sent: Friday, October 28, 2005 2:06 PM To: vendor-disclosure Cc: [email protected] Subject: Re: FW: iDEFENSE Security Advisory [IDEF1089] Multiple Vendor Lynx Command Injection Vulnerability On Fri, 28 Oct 2005, vendor-disclosure wrote: > Thomas, > > Thank you for responding. Please let us know how you'd like to proceed. Well, I need to know the technical details, to see what type of fix is needed, how it is tested, etc. Given the context in which your email arrived, I'm expecting to have to patch 2.8.5 and the current version. Without seeing the report, I can't make an estimate on how long it takes to fix, but would like to deal with it now. btw - [EMAIL PROTECTED] hasn't been used for several years (1998), and [email protected] since early 2004. > > Michael > > -----Original Message----- > From: vendor-disclosure [mailto:[EMAIL PROTECTED] > Sent: Thursday, October 27, 2005 1:53 PM > To: [EMAIL PROTECTED] > Cc: vendor-disclosure > Subject: FW: iDEFENSE Security Advisory [IDEF1089] Multiple Vendor Lynx > Command Injection Vulnerability > > The attached advisory and email was originally submitted on 09/08/2005, but > a response has not yet been received. In accordance with our vendor > disclosure policy (http://www.idefense.com/legal_disclosure.jsp) we will > proceed with public disclosure of this issue if acknowledgement of receipt > is not received within five business days. > > Regards, > Michael Sutton > > Michael Sutton > Director, iDEFENSE Labs > iDEFENSE > 1875 Campus Commons Drive, Suite 210 > Reston, VA 20191 > direct: 703.480.5628 > voice: 703.390.1230 > fax: 703.390.9456 > [EMAIL PROTECTED] > www.idefense.com > > -----Original Message----- > From: vendor-disclosure [mailto:[EMAIL PROTECTED] > Sent: Thursday, September 08, 2005 11:50 PM > To: [EMAIL PROTECTED] > Cc: vendor-disclosure > Subject: FW: iDEFENSE Security Advisory [IDEF1089] Multiple Vendor Lynx > Command Injection Vulnerability > > The message below bounced. > > -----Original Message----- > From: vendor-disclosure [mailto:[EMAIL PROTECTED] > Sent: Thursday, September 08, 2005 11:27 PM > To: [email protected] > Cc: vendor-disclosure > Subject: iDEFENSE Security Advisory [IDEF1089] Multiple Vendor Lynx Command > Injection Vulnerability > > iDEFENSE has identified a Command Injection vulnerability in Lynx. This > vulnerability was submitted to iDEFENSE through our Vulnerability > Contributor Program: > > http://www.idefense.com/poi/teams/vcp.jsp > > iDEFENSE Labs has validated this vulnerability and has drafted the > attached advisory. In accordance with our vendor disclosure policy > > http://www.idefense.com/legal_disclosure.jsp > > We would request that you acknowledge receipt of this initial > notification within five business days so that we may begin the process > of coordinating an appropriate public disclosure date for this issue > that will provide your company with adequate time to develop a patch or > workaround to mitigate this vulnerability. If you have questions > regarding this issue or require further details to assist with your own > analysis, please do not hesitate to contact us. > > It is always our goal to coordinate on the public disclosure of > patches/advisories as quickly as possible after a vulnerability is > discovered. If however a reasonable timeframe cannot be agreed upon for > this issue, it will be publicly released in 60 days on 11/08/2005. > iDEFENSE is willing to work with a vendor to find a mutually agreeable > release date beyond this timeframe so long as the vendor continues to > make good faith efforts to produce patches in a timely fashion and > regularly informs iDEFENSE of their progress in doing so. > > Please note that if the affected product is included within other > applications and/or operating systems, iDEFENSE will not be coordinating > disclosure of the vulnerability to affected third parties. We would ask > that you handle this coordination separately. > > Regards, > Michael Sutton > > Michael Sutton > Director, iDEFENSE Labs > iDEFENSE > 1875 Campus Commons Drive, Suite 210 > Reston, VA 20191 > direct: 703.480.5628 > voice: 703.390.1230 > fax: 703.390.9456 > [EMAIL PROTECTED] > www.idefense.com > -- Thomas E. Dickey http://invisible-island.net ftp://invisible-island.net
Multiple Vendor Lynx Command Injection Vulnerability
iDEFENSE Security Advisory XX.XX.05
www.idefense.com/application/poi/display?type=vulnerabilities
MMM DD, 2005
I. BACKGROUND
Lynx is a fully-featured WWW client for users running cursor-
addressable, character-cell display devices such as vt100 terminals and
terminal emulators. Lynx support a number of protocols including HTTP,
HTTPS, gopher, FTP, WAIS, NNTP, finger or cso/ph/qi servers, and
services accessible via log ons to telnet, tn3270 or rlogin accounts.
II. DESCRIPTION
Remote exploitation of a command injection vulnerability in various
vendors' implementations of Lynx could allow attackers to execute
arbitrary commands with the privileges of the underlying user.
The problem specifically exists within the feature to execute local
cgi-bin programs via the "lynxcgi:" URI handler. The handler is
generally intended to be restricted to a specific directory or
program(s). However, due to a configuration error on multiple platforms,
the default settings allow for arbitrary websites to specify commands to
run as the user running Lynx.
III. ANALYSIS
Successful exploitation of the described vulnerability allows remote
attackers to execute arbitrary commands with the privileges of the
underlying user. Exploitation requires that an attacker convince a
target user to follow a malicious link from within a vulnerable version
of Lynx. The "lynxexec" and "lynxprog" URI handlers can also be used to
trigger the issue. However, they are rarely compiled into the Lynx
binary.
IV. DETECTION
iDEFENSE has confirmed the existence of this vulnerability in the latest
stable release of Lynx, version 2.8.5. It is suspected that earlier
versions are also affected. The following vendors include susceptible
Lynx packages within their respective distributions:
* Red Hat Inc.
* Gentoo Foundation Inc.
* Mandriva SA
Other vendors are suspected as also being vulnerable. The following
vendors include Lynx packages that are not susceptible to exploitation
as the "lynxcgi" feature is not compiled into Lynx by default:
* The FreeBSD Project
* OpenBSD
V. WORKAROUND
Disable "lynxcgi" links by specifying the following directive in
lynx.cfg:
TRUSTED_LYNXCGI:none
VI. VENDOR RESPONSE
[Quoted vendor response if available. Otherwise include vendor fix
details.]
VII. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2005-2929 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.
VIII. DISCLOSURE TIMELINE
09/08/2005 Initial vendor notification
XX/XX/2005 Initial vendor response
XX/XX/2005 Coordinated public disclosure
IX. CREDIT
vade79 (http://fakehalo.us) is credited with this discovery.
Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp
Free tools, research and upcoming events
http://labs.idefense.com
X. LEGAL NOTICES
Copyright © 2005 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email [EMAIL PROTECTED] for permission.
Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.Title: lynxcgi: test execution html script.
This will create /tmp/lynx-test if vulnerable.
_______________________________________________ Lynx-dev mailing list [email protected] http://lists.nongnu.org/mailman/listinfo/lynx-dev
