REDHAT-BUG-214205
First published: Mon Nov 06 2006(Updated: )
Description of problem: Lynx reads .mailcap and .mime.types from its CWD, making it possible for a malicious person to make it execute arbitrairy code when user launches lynx while its working directory contains attacker-provided contents. Steps to Reproduce: $ cat .mime.types application/x-bug bug $ cat .mailcap application/x-bug; xmessage 'Hello, World!' $ cat poc.bug $ lynx poc.bug ( xmessage 'Hello, World!' ) < /home/lkundrak/L28618-1037TMP.bin ... Fix: Make lynx read files from ~ instead of CWD. Debian patch is unusable here, they completly remove code for reading the files in question.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lynx |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lynx.isc.org/lynx2.8.6/patches/
- http://lynx.isc.org/lynx2.8.5/patches/
- http://lynx.isc.org/lynx2.8.4/patches/
- https://bugzilla.redhat.com/show_bug.cgi/ftp:/lynx.isc.org/lynx2.8.5/patches/2.8.5rel.6.patch.gz
- https://bugzilla.redhat.com/show_bug.cgi/ftp:/lynx.isc.org/lynx2.8.4/patches/lynx2.8.4rel.1e.patch
- https://access.redhat.com/security/cve/CVE-2006-7234
- http://rhn.redhat.com/errata/RHSA-2008-0965.html
- https://bugzilla.redhat.com/show_bug.cgi?id=214205
Frequently Asked Questions
What is the severity of REDHAT-BUG-214205?
REDHAT-BUG-214205 has a critical severity as it allows execution of arbitrary code through maliciously crafted .mime.types files.
How do I fix REDHAT-BUG-214205?
To fix REDHAT-BUG-214205, ensure that Lynx does not have access to untrusted directories and avoid running it from directories containing potential malicious files.
Which versions of Lynx are affected by REDHAT-BUG-214205?
Lynx versions prior to 2.8.6 are affected by REDHAT-BUG-214205.
What are the potential implications of REDHAT-BUG-214205?
The implications of REDHAT-BUG-214205 include unauthorized access and execution of malicious code on the user's system.
Is there any workaround for REDHAT-BUG-214205?
A temporary workaround for REDHAT-BUG-214205 is to run Lynx from a secure directory that doesn't contain user-modifiable .mime.types or .mailcap files.
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2006-7234
- agent/source
- agent/description
- agent/severity
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lynx
- canonical/lynx