Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2008:218 | First vendor Publication | 2008-10-28 |
| Vendor | Mandriva | Last vendor Modification | 2008-10-28 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability was found in the Lynxcgi: URI handler that could allow an attacker to create a web page redirecting to a malicious URL that would execute arbitrary code as the user running Lynx, if they were using the non-default Advanced user mode (CVE-2008-4690). This update corrects these issues and, in addition, makes Lynx always prompt the user before loading a lynxcgi: URI. As well, the default lynx.cfg configuration file marks all lynxcgi: URIs as untrusted. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2008:218 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11204 | |||
| Oval ID: | oval:org.mitre.oval:def:11204 | ||
| Title: | lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler. | ||
| Description: | lynx 2.8.6dev.15 and earlier, when advanced mode is enabled and lynx is configured as a URL handler, allows remote attackers to execute arbitrary commands via a crafted lynxcgi: URL, a related issue to CVE-2005-2929. NOTE: this might only be a vulnerability in limited deployments that have defined a lynxcgi: handler. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-4690 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:28964 | |||
| Oval ID: | oval:org.mitre.oval:def:28964 | ||
| Title: | RHSA-2008:0965 -- lynx security update (Important) | ||
| Description: | An updated lynx package that corrects two security issues is now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Lynx is a text-based Web browser. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2008:0965 CESA-2008:0965-CentOS 5 CESA-2008:0965-CentOS 3 CESA-2008:0965-CentOS 2 CVE-2006-7234 CVE-2008-4690 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 CentOS Linux 3 CentOS Linux 2 | Product(s): | lynx |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-09-15 | Name : Gentoo Security Advisory GLSA 200909-15 (lynx) File : nvt/glsa_200909_15.nasl |
| 2009-04-09 | Name : Mandriva Update for lynx MDVSA-2008:218 (lynx) File : nvt/gb_mandriva_MDVSA_2008_218.nasl |
| 2009-03-06 | Name : RedHat Update for lynx RHSA-2008:0965-01 File : nvt/gb_RHSA-2008_0965-01_lynx.nasl |
| 2009-02-27 | Name : CentOS Update for lynx CESA-2008:0965-01 centos2 i386 File : nvt/gb_CESA-2008_0965-01_lynx_centos2_i386.nasl |
| 2009-02-27 | Name : CentOS Update for lynx CESA-2008:0965 centos3 i386 File : nvt/gb_CESA-2008_0965_lynx_centos3_i386.nasl |
| 2009-02-27 | Name : CentOS Update for lynx CESA-2008:0965 centos3 x86_64 File : nvt/gb_CESA-2008_0965_lynx_centos3_x86_64.nasl |
| 2009-02-27 | Name : CentOS Update for lynx CESA-2008:0965 centos4 i386 File : nvt/gb_CESA-2008_0965_lynx_centos4_i386.nasl |
| 2009-02-27 | Name : CentOS Update for lynx CESA-2008:0965 centos4 x86_64 File : nvt/gb_CESA-2008_0965_lynx_centos4_x86_64.nasl |
| 2009-02-17 | Name : Fedora Update for lynx FEDORA-2008-9550 File : nvt/gb_fedora_2008_9550_lynx_fc9.nasl |
| 2009-02-17 | Name : Fedora Update for lynx FEDORA-2008-9597 File : nvt/gb_fedora_2008_9597_lynx_fc8.nasl |
| 2009-02-17 | Name : Fedora Update for lynx FEDORA-2008-9952 File : nvt/gb_fedora_2008_9952_lynx_fc10.nasl |
| 2009-01-20 | Name : SuSE Security Summary SUSE-SR:2009:002 File : nvt/suse_sr_2009_002.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 49479 | Lynx Crafted lynxcgi: URL Handling Arbitrary Remote Code Execution |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2008-0965.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20081027_lynx_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
| 2009-09-14 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200909-15.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_lynx-081030.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2008-9952.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2008-218.nasl - Type : ACT_GATHER_INFO |
| 2008-12-03 | Name : The remote Fedora host is missing a security update. File : fedora_2008-9550.nasl - Type : ACT_GATHER_INFO |
| 2008-12-03 | Name : The remote Fedora host is missing a security update. File : fedora_2008-9597.nasl - Type : ACT_GATHER_INFO |
| 2008-12-01 | Name : The remote openSUSE host is missing a security update. File : suse_lynx-5720.nasl - Type : ACT_GATHER_INFO |
| 2008-10-28 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2008-0965.nasl - Type : ACT_GATHER_INFO |
| 2008-10-28 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2008-0965.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:39:46 |
|
