CVE-1999-1549: High severity university of kansas lynx vulnerability
Lynx 2.x does not properly distinguish between internal and external HTML, which may allow a local attacker to read a "secure" hidden form value from a temporary file and craft a LYNXOPTIONS: URL that causes Lynx to modify the user's configuration file and execute commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable processing of LYNXOPTIONS: URLs in Lynx to prevent crafted LYNXOPTIONS URLs from modifying the user's configuration file and executing commands.
Lynx LYNXOPTIONS URL handling = disabled - Compensating control
Restrict access to Lynx temporary files and directories so local attackers cannot read secure hidden form values (tighten permissions on temporary files used by Lynx).
- Operational
Inspect user configuration files for unauthorized modifications caused by crafted LYNXOPTIONS URLs; revert or remove malicious changes and investigate any commands that may have been executed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1549?
CVE-1999-1549 is considered a high severity vulnerability due to its potential for local exploitation and exposure of secure information.
How do I fix CVE-1999-1549?
To fix CVE-1999-1549, update Lynx to the latest version that addresses this vulnerability.
What versions of Lynx are affected by CVE-1999-1549?
CVE-1999-1549 affects Lynx versions 2.7 and 2.8.
What type of attack does CVE-1999-1549 allow?
CVE-1999-1549 allows a local attacker to read hidden secure form values and modify the user's configuration file.
Can CVE-1999-1549 be exploited remotely?
No, CVE-1999-1549 requires local access to exploit the vulnerability.