drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ungewolltes Einfügen von Newlines in Kommandozeilenoptionen von lynx
Name: |
Ungewolltes Einfügen von Newlines in Kommandozeilenoptionen von lynx
|
|
ID: |
RHSA-2003:029-06 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat Linux |
|
Datum: |
Fr, 14. Februar 2003, 12:00 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1405
http://www.mail-archive.com/bugtraq@securityfocus.com/msg08897.html |
|
Applikationen: |
Lynx |
|
Originalnachricht |
--------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory
Synopsis: Updated lynx packages fix CRLF injection vulnerability Advisory ID: RHSA-2003:029-06 Issue date: 2003-01-28 Updated on: 2003-02-12 Product: Red Hat Linux Keywords: lynx CRLF Cross references: Obsoletes: CVE Names: CAN-2002-1405 ---------------------------------------------------------------------
1. Topic:
Updated lynx packages are available that fix an error in the way lynx parses its command line arguments, which can lead to faked headers being sent to a web server.
2. Relevant releases/architectures:
Red Hat Linux 6.2 - i386 Red Hat Linux 7.0 - i386 Red Hat Linux 7.1 - i386 Red Hat Linux 7.2 - i386, ia64 Red Hat Linux 7.3 - i386 Red Hat Linux 8.0 - i386
3. Problem description:
Lynx is a character-cell Web browser, suitable for running on terminals such as VT100.
Lynx constructs its HTTP queries from the command line (or WWW_HOME environment variable) without regard to special characters such as carriage returns or linefeeds. When given a URL containing such special characters, extra headers could be inserted into the request. This could cause scripts using lynx to fetch data from the wrong site from servers with virtual hosting.
Users of Lynx are advised to upgrade to these erratum packages, which contain a patch to correct this isssue.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.
Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
5. RPMs required:
Red Hat Linux 6.2:
SRPMS: ftp://updates.redhat.com/6.2/en/os/SRPMS/lynx-2.8.3-2.1.src.rpm
i386: ftp://updates.redhat.com/6.2/en/os/i386/lynx-2.8.3-2.1.i386.rpm
Red Hat Linux 7.0:
SRPMS: ftp://updates.redhat.com/7.0/en/os/SRPMS/lynx-2.8.4-9.1.src.rpm
i386: ftp://updates.redhat.com/7.0/en/os/i386/lynx-2.8.4-9.1.i386.rpm
Red Hat Linux 7.1:
SRPMS: ftp://updates.redhat.com/7.1/en/os/SRPMS/lynx-2.8.4-9.1.src.rpm
i386: ftp://updates.redhat.com/7.1/en/os/i386/lynx-2.8.4-9.1.i386.rpm
Red Hat Linux 7.2:
SRPMS: ftp://updates.redhat.com/7.2/en/os/SRPMS/lynx-2.8.4-18.1.src.rpm
i386: ftp://updates.redhat.com/7.2/en/os/i386/lynx-2.8.4-18.1.i386.rpm
ia64: ftp://updates.redhat.com/7.2/en/os/ia64/lynx-2.8.4-18.1.ia64.rpm
Red Hat Linux 7.3:
SRPMS: ftp://updates.redhat.com/7.3/en/os/SRPMS/lynx-2.8.4-18.1.src.rpm
i386: ftp://updates.redhat.com/7.3/en/os/i386/lynx-2.8.4-18.1.i386.rpm
Red Hat Linux 8.0:
SRPMS: ftp://updates.redhat.com/8.0/en/os/SRPMS/lynx-2.8.5-7.1.src.rpm
i386: ftp://updates.redhat.com/8.0/en/os/i386/lynx-2.8.5-7.1.i386.rpm
6. Verification:
MD5 sum Package Name -------------------------------------------------------------------------- ee2ec726b41f93d3787abbcf2760cdfe 6.2/en/os/SRPMS/lynx-2.8.3-2.1.src.rpm 4f8b6cafe29d38e498e8d495ec687e8d 6.2/en/os/i386/lynx-2.8.3-2.1.i386.rpm 2ef0ea9eaacd3745869855b3e09b3094 7.0/en/os/SRPMS/lynx-2.8.4-9.1.src.rpm fdf7f4ede3587e9ee9bad3b722da5f0e 7.0/en/os/i386/lynx-2.8.4-9.1.i386.rpm 2ef0ea9eaacd3745869855b3e09b3094 7.1/en/os/SRPMS/lynx-2.8.4-9.1.src.rpm fdf7f4ede3587e9ee9bad3b722da5f0e 7.1/en/os/i386/lynx-2.8.4-9.1.i386.rpm 45dbab8b692beafc8e9bfb367bc37892 7.2/en/os/SRPMS/lynx-2.8.4-18.1.src.rpm da2e0cc072fe3f313a4cd1ba1d2a9229 7.2/en/os/i386/lynx-2.8.4-18.1.i386.rpm c9f787ae94edc0182b015524593f82a7 7.2/en/os/ia64/lynx-2.8.4-18.1.ia64.rpm 45dbab8b692beafc8e9bfb367bc37892 7.3/en/os/SRPMS/lynx-2.8.4-18.1.src.rpm da2e0cc072fe3f313a4cd1ba1d2a9229 7.3/en/os/i386/lynx-2.8.4-18.1.i386.rpm 6e0af76d0632ec353555843a84bb2a02 8.0/en/os/SRPMS/lynx-2.8.5-7.1.src.rpm 96fd9d05a357e6a0d11d5a2916b90485 8.0/en/os/i386/lynx-2.8.5-7.1.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key is available at http://www.redhat.com/about/contact/pgpkey.html
You can verify each package with the following command: rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum <filename>
7. References:
http://www.mail-archive.com/bugtraq@securityfocus.com/msg08897.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1405
8. Contact:
The Red Hat security contact is <security@redhat.com>. More contact details at http://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
_______________________________________________ Redhat-watch-list mailing list To unsubscribe, visit: https://listman.redhat.com/mailman/listinfo/redhat-watch-list
|
|
|
|