Red Hat Product Errata RHSA-2005:839 - Security Advisory
Issued:
2005-11-11
Updated:
2005-11-11

RHSA-2005:839 - Security Advisory

Synopsis

lynx security update

Type/Severity

Security Advisory: Critical

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An updated lynx package that corrects a security flaw is now available.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Description

Lynx is a text-based Web browser.

An arbitrary command execute bug was found in the lynx "lynxcgi:" URI
handler. An attacker could create a web page redirecting to a malicious URL
which could execute arbitrary code as the user running lynx. The Common
Vulnerabilities and Exposures project assigned the name CVE-2005-2929 to
this issue.

Users should update to this erratum package, which contains a backported
patch to correct this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server 2 ia64
  • Red Hat Enterprise Linux Server 2 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Workstation 2 ia64
  • Red Hat Enterprise Linux Workstation 2 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

  • BZ - 172972 - CVE-2005-2929 lynx arbitrary command execution

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
x86_64
lynx-2.8.5-18.2.x86_64.rpm SHA-256: 2b859292f285a2680f76f6be5953cccc1ef113674035abb3c452688b5d51ede0
lynx-2.8.5-18.2.x86_64.rpm SHA-256: 2b859292f285a2680f76f6be5953cccc1ef113674035abb3c452688b5d51ede0
ia64
lynx-2.8.5-18.2.ia64.rpm SHA-256: 1829ade1dd7c18817758bd79b52715e585bf891d1615bd88dfb03c3360e585f1
lynx-2.8.5-18.2.ia64.rpm SHA-256: 1829ade1dd7c18817758bd79b52715e585bf891d1615bd88dfb03c3360e585f1
i386
lynx-2.8.5-18.2.i386.rpm SHA-256: 092ef6ebeb069051cb8d515e6184f55d0926d4089da161d8f62b2dc0bbe35c37
lynx-2.8.5-18.2.i386.rpm SHA-256: 092ef6ebeb069051cb8d515e6184f55d0926d4089da161d8f62b2dc0bbe35c37

Red Hat Enterprise Linux Server 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Server 2

SRPM
ia64
i386

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
lynx-2.8.5-18.2.x86_64.rpm SHA-256: 2b859292f285a2680f76f6be5953cccc1ef113674035abb3c452688b5d51ede0
ia64
lynx-2.8.5-18.2.ia64.rpm SHA-256: 1829ade1dd7c18817758bd79b52715e585bf891d1615bd88dfb03c3360e585f1
i386
lynx-2.8.5-18.2.i386.rpm SHA-256: 092ef6ebeb069051cb8d515e6184f55d0926d4089da161d8f62b2dc0bbe35c37

Red Hat Enterprise Linux Workstation 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 2

SRPM
ia64
i386

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
lynx-2.8.5-18.2.x86_64.rpm SHA-256: 2b859292f285a2680f76f6be5953cccc1ef113674035abb3c452688b5d51ede0
i386
lynx-2.8.5-18.2.i386.rpm SHA-256: 092ef6ebeb069051cb8d515e6184f55d0926d4089da161d8f62b2dc0bbe35c37

Red Hat Enterprise Linux Desktop 3

SRPM
x86_64
i386

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
lynx-2.8.5-18.2.s390x.rpm SHA-256: a20a2dada92dcde329ede530e30f1af759e2449d1280defb4a9bd355a1cbb3df
s390
lynx-2.8.5-18.2.s390.rpm SHA-256: 870c0f70c4c54778b285f0e7bcf7525db6021f152c31a7dfaff15b34e075ce2f

Red Hat Enterprise Linux for IBM z Systems 3

SRPM
s390x
s390

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
lynx-2.8.5-18.2.ppc.rpm SHA-256: cc6b6c177bd801d8ab5a4e0acd80939cccb4f9aff47e87e9e15470d4e5504b5d

Red Hat Enterprise Linux for Power, big endian 3

SRPM
ppc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.