REDHAT-BUG-214205: Low severity lynx vulnerability
Description of problem:
Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents.
Steps to Reproduce:
$ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug
( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin
...
Fix:
Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-214205?
REDHAT-BUG-214205 has a critical severity as it allows execution of arbitrary code through maliciously crafted .mime.types files.
How do I fix REDHAT-BUG-214205?
To fix REDHAT-BUG-214205, ensure that Lynx does not have access to untrusted directories and avoid running it from directories containing potential malicious files.
Which versions of Lynx are affected by REDHAT-BUG-214205?
Lynx versions prior to 2.8.6 are affected by REDHAT-BUG-214205.
What are the potential implications of REDHAT-BUG-214205?
The implications of REDHAT-BUG-214205 include unauthorized access and execution of malicious code on the user's system.
Is there any workaround for REDHAT-BUG-214205?
A temporary workaround for REDHAT-BUG-214205 is to run Lynx from a secure directory that doesn't contain user-modifiable .mime.types or .mailcap files.