CVE-2006-7234: Medium severity lynx lynx vulnerability
Description of problem:
Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.
Steps to Reproduce:
$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug
( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin
...
Fix:
Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.
Other sources
Untrusted search path vulnerability in Lynx before 2.8.6rel.4 allows local users to execute arbitrary code via malicious (1) .mailcap and (2) mime.types files in the current working directory.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-7234?
CVE-2006-7234 has a medium severity rating as it allows local users to execute arbitrary code.
How do I fix CVE-2006-7234?
To fix CVE-2006-7234, update Lynx to version 2.8.6rel.4 or later.
Which Lynx versions are affected by CVE-2006-7234?
CVE-2006-7234 affects Lynx versions before 2.8.6rel.4.
How does CVE-2006-7234 exploit untrusted search paths?
CVE-2006-7234 exploits untrusted search paths by allowing malicious .mailcap and mime.types files in the working directory to execute code.
Who is impacted by CVE-2006-7234?
Local users on systems running vulnerable versions of Lynx are impacted by CVE-2006-7234.