Technical Description

Fedora has released updated packages to correct a vulnerability identified in Lynx. This flaw is due to an input validation error when processing specially crafted arguments passed to the "lynxcgi" URI handler, which could be exploited by remote attackers to execute arbitrary commands by convincing a user to follow a malicious link. For additional information, see : VUPEN/ADV-2005-2394

Affected Products

Fedora Core 3
Fedora Core 4

Solution

Upgrade the affected packages :

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

024cace7abc7af6585a7d870c5e32aca SRPMS/lynx-2.8.5-18.0.2.src.rpm
fe3aee61b6e59d3216a2019dd10ce83d x86_64/lynx-2.8.5-18.0.2.x86_64.rpm
f26deb1648a100ba2b95ff2b5cdee5e2 x86_64/debug/lynx-debuginfo-2.8.5-18.0.2.x86_64.rpm
dce5c4c57ee166fc003568ba53dfcfb9 i386/lynx-2.8.5-18.0.2.i386.rpm
d26646eabbd780feca47744cebbbd322 i386/debug/lynx-debuginfo-2.8.5-18.0.2.i386.rpm

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/

98dc3b4932b605920708445ec041ee44 SRPMS/lynx-2.8.5-23.2.src.rpm
5c51bd2ee18e3ecdc29d7f4ad07e1d15 ppc/lynx-2.8.5-23.2.ppc.rpm
dddcc8d0b74aafeaa6ca3e26ec018702 ppc/debug/lynx-debuginfo-2.8.5-23.2.ppc.rpm
7e1d5d389ddaf45273eb3fa2162c6697 x86_64/lynx-2.8.5-23.2.x86_64.rpm
f7845d69bbd08e15440e417edef22d3e x86_64/debug/lynx-debuginfo-2.8.5-23.2.x86_64.rpm
c9cd3d4c174dab49a1f93a2337e598e4 i386/lynx-2.8.5-23.2.i386.rpm
b803a08da020c020d23ed7de20885309 i386/debug/lynx-debuginfo-2.8.5-23.2.i386.rpm

References

http://www.vupen.com/english/advisories/2005/2422
http://www.frsirt.com/english/reference/757
http://www.frsirt.com/english/reference/759

ChangeLog

2005-11-15 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.