Login
Newsletter
Werbung

Sicherheit: Ausführen beliebiger Kommandos in lynx
Aktuelle Meldungen Distributionen
Name: Ausführen beliebiger Kommandos in lynx
ID: MDVSA-2008:218
Distribution: Mandriva
Plattformen: Mandriva 2008.0, Mandriva 2008.1, Mandriva 2009.0
Datum: Di, 28. Oktober 2008, 22:05
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4690
Applikationen: Lynx

Originalnachricht

This is a multi-part message in MIME format...

------------=_1225227913-14940-1569


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:218
http://www.mandriva.com/security/
_______________________________________________________________________

Package : lynx
Date : October 28, 2008
Affected: 2008.0, 2008.1, 2009.0
_______________________________________________________________________

Problem Description:

A vulnerability was found in the Lynxcgi: URI handler that could allow
an attacker to create a web page redirecting to a malicious URL that
would execute arbitrary code as the user running Lynx, if they were
using the non-default Advanced user mode (CVE-2008-4690).

This update corrects these issues and, in addition, makes Lynx always
prompt the user before loading a lynxcgi: URI. As well, the default
lynx.cfg configuration file marks all lynxcgi: URIs as untrusted.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4690
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2008.0:
2a6a4130c12d3d45d926b49713420272 2008.0/i586/lynx-2.8.6-2.1mdv2008.0.i586.rpm

aa0ff44a80fa5b485b54f52d12b485f2 2008.0/SRPMS/lynx-2.8.6-2.1mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
dcabb93ba8e48a0a96a632d2c8b11cb4
2008.0/x86_64/lynx-2.8.6-2.1mdv2008.0.x86_64.rpm
aa0ff44a80fa5b485b54f52d12b485f2 2008.0/SRPMS/lynx-2.8.6-2.1mdv2008.0.src.rpm

Mandriva Linux 2008.1:
1e04683750a061eecbe58c1b4fe7b173 2008.1/i586/lynx-2.8.6-2.1mdv2008.1.i586.rpm

68ddd2a1b9f991c11793a51dfbe9d9cb 2008.1/SRPMS/lynx-2.8.6-2.1mdv2008.1.src.rpm

Mandriva Linux 2008.1/X86_64:
3ae02ae07a01e65aa16e3317e2d7afb0
2008.1/x86_64/lynx-2.8.6-2.1mdv2008.1.x86_64.rpm
68ddd2a1b9f991c11793a51dfbe9d9cb 2008.1/SRPMS/lynx-2.8.6-2.1mdv2008.1.src.rpm

Mandriva Linux 2009.0:
65c1c0a4cf6a8758bc8506b9a7b1d3c4 2009.0/i586/lynx-2.8.6-2.1mdv2009.0.i586.rpm

0026bfc6799a2242afd794932ce0b5a8 2009.0/SRPMS/lynx-2.8.6-2.1mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
0ad22b9ff40e6c7b8fc8ce25c4ef51cc
2009.0/x86_64/lynx-2.8.6-2.1mdv2009.0.x86_64.rpm
0026bfc6799a2242afd794932ce0b5a8 2009.0/SRPMS/lynx-2.8.6-2.1mdv2009.0.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFJB1LHmqjQ0CJFipgRAqQNAJwJ7ePHFR/FopDId6tWFKhc0kLHPQCeKF/e
r+RQJ0K1ymIZKh/t9S9NxI4=
=gays
-----END PGP SIGNATURE-----


------------=_1225227913-14940-1569
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1225227913-14940-1569--
Pro-Linux
Gewinnspiel
Neue Nachrichten
Werbung