CVE-1999-0817: Critical severity university of kansas lynx vulnerability
Lynx WWW client allows a remote attacker to specify command-line parameters which Lynx uses when calling external programs to handle certain protocols, e.g. telnet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Lynxfrom your environment.Uninstall Lynx if it is not required to remove exposure to this behavior.
- Configuration
Disable Lynx's use of external programs to handle protocols so it does not pass remote-supplied command-line parameters to external programs.
Lynx external_protocol_handlers = disabled - Configuration
Disable handling of telnet: (and other external-protocol) URLs to prevent Lynx from invoking external telnet clients with attacker-supplied parameters.
Lynx telnet_handler = disabled - Compensating control
Block or filter telnet and other external-protocol schemes at the network perimeter, proxy, or gateway so users cannot reach or cause Lynx to invoke external protocol handlers.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0817?
CVE-1999-0817 has a moderate severity rating due to its potential for abuse by remote attackers.
How do I fix CVE-1999-0817?
To fix CVE-1999-0817, you should upgrade to the latest version of Lynx that addresses this vulnerability.
Which versions of Lynx are affected by CVE-1999-0817?
CVE-1999-0817 can affect various versions of Lynx, so it's important to check the specific version in use.
What type of attack is possible with CVE-1999-0817?
CVE-1999-0817 allows remote attackers to exploit command-line parameters when Lynx calls external programs.
Is Lynx still a widely used browser affected by CVE-1999-0817?
While Lynx is less commonly used today, it is still found in specific environments, making CVE-1999-0817 a relevant vulnerability.