[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[RedHat] Schwachstellen in lynx - RHSA-2008:0965-01
-----BEGIN PGP SIGNED MESSAGE-----
Liebe Kolleginnen und Kollegen,
soeben erreichte uns nachfolgendes RedHat Security Advisory. Wir geben
diese Informationen unveraendert an Sie weiter.
CVE-2008-4690 - Schwachstelle in lynx URL Handler
Die Schwachstelle CVE-2005-2929 in lynx in Verbindung mit lynxcgi wurde
nicht geschlossen, sondern durch den Patch wurde der Zugriff auf lynxcgi
im Normal Modus unterbunden. Die Schwachstelle laesst sich im weiter im
Advanced Modus ausnutzen. Dies kann z.B. der Fall sein, wenn lynx von
der Kommandozeile gestartet wurde und der URL Handler fuer lynxcgi://
aktiviert ist. Ein entfernter Angreifer kann diese Schwachstelle
ausnutzen um beliebige Befehle mit den Rechten des Benutzers
auszufuehren.
CVE-2006-7234 - Schwachstelle in lynx
Der Browser lynx oeffnet beim Start die Dateien ".mime.types" und
".mailcap" im lokalem Verzeichnis. Ein lokaler Angreifer kann eine
entsprechende Datei anlegen und wenn ein Benutzer lynx in dem
Verzeichnis aufruft, werden Befehle mit den Rechten des Benutzers
ausgefuehrt.
Betroffen sind die folgenden Software Pakete und Plattformen:
Paket lynx
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x,
x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x,
x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Vom Hersteller werden ueberarbeitete Pakete zur Verfuegung gestellt.
Hersteller Advisory:
https://rhn.redhat.com/errata/RHSA-2008-0965.html
(c) der deutschen Zusammenfassung bei DFN-CERT Services GmbH; die
Verbreitung, auch auszugsweise, ist nur unter Hinweis auf den Urheber,
DFN-CERT Services GmbH, und nur zu nicht kommerziellen Zwecken
gestattet.
Mit freundlichen Gruessen,
Klaus Moeller, DFN-CERT
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: lynx security update
Advisory ID: RHSA-2008:0965-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0965.html
Issue date: 2008-10-27
CVE Names: CVE-2008-4690 CVE-2006-7234
=====================================================================
1. Summary:
An updated lynx package that corrects two security issues is now available
for Red Hat Enterprise Linux 2.1, 3, 4, and 5.
This update has been rated as having important security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
3. Description:
Lynx is a text-based Web browser.
An arbitrary command execution flaw was found in the Lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
that could execute arbitrary code as the user running Lynx in the
non-default "Advanced" user mode. (CVE-2008-4690)
Note: In these updated lynx packages, Lynx will always prompt users before
loading a "lynxcgi:" URI. Additionally, the default lynx.cfg configuration
file now marks all "lynxcgi:" URIs as untrusted by default.
A flaw was found in a way Lynx handled ".mailcap" and ".mime.types"
configuration files. Files in the browser's current working directory were
opened before those in the user's home directory. A local attacker, able to
convince a user to run Lynx in a directory under their control, could
possibly execute arbitrary commands as the user running Lynx. (CVE-2006-7234)
All users of Lynx are advised to upgrade to this updated package, which
contains backported patches correcting these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bugs fixed (http://bugzilla.redhat.com/):
214205 - CVE-2006-7234 lynx: .mailcap and .mime.types files read from CWD
468184 - CVE-2008-4690 lynx: remote arbitrary command execution via a crafted lynxcgi: URL
6. Package List:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 :
Source:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/lynx-2.8.4-18.1.3.src.rpm
i386:
lynx-2.8.4-18.1.3.i386.rpm
ia64:
lynx-2.8.4-18.1.3.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
Source:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/lynx-2.8.4-18.1.3.src.rpm
ia64:
lynx-2.8.4-18.1.3.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
Source:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/lynx-2.8.4-18.1.3.src.rpm
i386:
lynx-2.8.4-18.1.3.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
Source:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/lynx-2.8.4-18.1.3.src.rpm
i386:
lynx-2.8.4-18.1.3.i386.rpm
Red Hat Enterprise Linux AS version 3:
Source:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/lynx-2.8.5-11.3.src.rpm
i386:
lynx-2.8.5-11.3.i386.rpm
lynx-debuginfo-2.8.5-11.3.i386.rpm
ia64:
lynx-2.8.5-11.3.ia64.rpm
lynx-debuginfo-2.8.5-11.3.ia64.rpm
ppc:
lynx-2.8.5-11.3.ppc.rpm
lynx-debuginfo-2.8.5-11.3.ppc.rpm
s390:
lynx-2.8.5-11.3.s390.rpm
lynx-debuginfo-2.8.5-11.3.s390.rpm
s390x:
lynx-2.8.5-11.3.s390x.rpm
lynx-debuginfo-2.8.5-11.3.s390x.rpm
x86_64:
lynx-2.8.5-11.3.x86_64.rpm
lynx-debuginfo-2.8.5-11.3.x86_64.rpm
Red Hat Desktop version 3:
Source:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/lynx-2.8.5-11.3.src.rpm
i386:
lynx-2.8.5-11.3.i386.rpm
lynx-debuginfo-2.8.5-11.3.i386.rpm
x86_64:
lynx-2.8.5-11.3.x86_64.rpm
lynx-debuginfo-2.8.5-11.3.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
Source:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/lynx-2.8.5-11.3.src.rpm
i386:
lynx-2.8.5-11.3.i386.rpm
lynx-debuginfo-2.8.5-11.3.i386.rpm
ia64:
lynx-2.8.5-11.3.ia64.rpm
lynx-debuginfo-2.8.5-11.3.ia64.rpm
x86_64:
lynx-2.8.5-11.3.x86_64.rpm
lynx-debuginfo-2.8.5-11.3.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
Source:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/lynx-2.8.5-11.3.src.rpm
i386:
lynx-2.8.5-11.3.i386.rpm
lynx-debuginfo-2.8.5-11.3.i386.rpm
ia64:
lynx-2.8.5-11.3.ia64.rpm
lynx-debuginfo-2.8.5-11.3.ia64.rpm
x86_64:
lynx-2.8.5-11.3.x86_64.rpm
lynx-debuginfo-2.8.5-11.3.x86_64.rpm
Red Hat Enterprise Linux AS version 4:
Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/lynx-2.8.5-18.2.el4_7.1.src.rpm
i386:
lynx-2.8.5-18.2.el4_7.1.i386.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.i386.rpm
ia64:
lynx-2.8.5-18.2.el4_7.1.ia64.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.ia64.rpm
ppc:
lynx-2.8.5-18.2.el4_7.1.ppc.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.ppc.rpm
s390:
lynx-2.8.5-18.2.el4_7.1.s390.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.s390.rpm
s390x:
lynx-2.8.5-18.2.el4_7.1.s390x.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.s390x.rpm
x86_64:
lynx-2.8.5-18.2.el4_7.1.x86_64.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/lynx-2.8.5-18.2.el4_7.1.src.rpm
i386:
lynx-2.8.5-18.2.el4_7.1.i386.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.i386.rpm
x86_64:
lynx-2.8.5-18.2.el4_7.1.x86_64.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/lynx-2.8.5-18.2.el4_7.1.src.rpm
i386:
lynx-2.8.5-18.2.el4_7.1.i386.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.i386.rpm
ia64:
lynx-2.8.5-18.2.el4_7.1.ia64.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.ia64.rpm
x86_64:
lynx-2.8.5-18.2.el4_7.1.x86_64.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/lynx-2.8.5-18.2.el4_7.1.src.rpm
i386:
lynx-2.8.5-18.2.el4_7.1.i386.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.i386.rpm
ia64:
lynx-2.8.5-18.2.el4_7.1.ia64.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.ia64.rpm
x86_64:
lynx-2.8.5-18.2.el4_7.1.x86_64.rpm
lynx-debuginfo-2.8.5-18.2.el4_7.1.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/lynx-2.8.5-28.1.el5_2.1.src.rpm
i386:
lynx-2.8.5-28.1.el5_2.1.i386.rpm
lynx-debuginfo-2.8.5-28.1.el5_2.1.i386.rpm
x86_64:
lynx-2.8.5-28.1.el5_2.1.x86_64.rpm
lynx-debuginfo-2.8.5-28.1.el5_2.1.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/lynx-2.8.5-28.1.el5_2.1.src.rpm
i386:
lynx-2.8.5-28.1.el5_2.1.i386.rpm
lynx-debuginfo-2.8.5-28.1.el5_2.1.i386.rpm
ia64:
lynx-2.8.5-28.1.el5_2.1.ia64.rpm
lynx-debuginfo-2.8.5-28.1.el5_2.1.ia64.rpm
ppc:
lynx-2.8.5-28.1.el5_2.1.ppc.rpm
lynx-debuginfo-2.8.5-28.1.el5_2.1.ppc.rpm
s390x:
lynx-2.8.5-28.1.el5_2.1.s390x.rpm
lynx-debuginfo-2.8.5-28.1.el5_2.1.s390x.rpm
x86_64:
lynx-2.8.5-28.1.el5_2.1.x86_64.rpm
lynx-debuginfo-2.8.5-28.1.el5_2.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4690
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7234
http://www.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@xxxxxxxxxx>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2008 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD8DBQFJBfcrXlSAg2UNWIIRAufQAKCRhP/uxRa7PihwJ4hLe719B9FCcQCgt27E
pVzCY2+MlVjopXLt+zwX/aw=
=Tsds
- -----END PGP SIGNATURE-----
- --
Dipl. Inform. Klaus Moeller (Incident Response Team)
Phone: +49 40 808077-555, Fax: +49 40 808077-556
DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555
Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstrase 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski
Automatische Warnmeldungen https://www.cert.dfn.de/autowarn
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iQEVAwUBSQdCPUhXCWfrVVdXAQGKUAgAg6fw7+g981AIP7AGwGIHyEuhtfXyqaBP
nH40FW6BzPjNsClm0oxxHB/WoIHNsfAVRimO1hbm+J6ApKTFZD+xYpEfkyEUClBL
cahHC1ArogiUBqdtUgPGRSgiH1xDkQ/+zJCa/AlkRrSYLxxZlCMq0ukqDknCqttg
xWZ505/vtt5DXqS3McKrlzLe8JbTg4MCCiak6pov6RWAXLY/APDv0NiIEwpqOEuV
2/NvHoBiKmehZR4tK2vVO9w3chxXZWNLqvbXVT5OLSHRnf7iVGZKFxN+WyE/Q969
G0xmeOj9+kl882o1l77P3nvU2NA66extls0nk7pTddMOqr7ShHb0KQ==
=eA3V
-----END PGP SIGNATURE-----