CRLF injection vulnerability in Lynx 2.8.4 and earlier allows remote attackers to inject false HTTP headers into an HTTP request that is provided on the command line, via a URL containing encoded carriage return, line feed, and other whitespace characters.

lynx (a text-only web browser) did not properly check for illegal characters in all places, including processing of command line options, which could be used to insert extra HTTP headers in a request.

For Debian GNU/Linux 2.2/potato this has been fixed in version 2.8.3-1.1 of the lynx package and version 2.8.3.1-1.1 of the lynx-ssl package.

For Debian GNU/Linux 3.0/woody this has been fixed in version 2.8.4.1b-3.2 of the lynx package and version 1:2.8.4.1b-3.1 of the lynx-ssl package.

The remote host is using Lynx as a web browser. The version used is vulnerable to a command line header injection which may allow an attacker to use Lynx to send potentially harmful requests. An attacker may use this flaw to attack third party hosts even from a limited (ie: lynx-only) environment. 

A vulnerability was discovered in lynx, a text-mode web browser. The HTTP queries that lynx constructs are from arguments on the command line or the $WWW_HOME environment variable, but lynx does not properly sanitize special characters such as carriage returns or linefeeds.
Extra headers can be inserted into the request because of this, which can cause scripts that use lynx to fetch data from the wrong site from servers that use virtual hosting.

Updated Lynx packages fix an error in the way Lynx parses its command line arguments which can lead to faked headers being sent to a Web server.

Lynx is a character-cell Web browser, suitable for running on terminals such as the VT100.

Lynx constructs its HTTP queries from the command line (or WWW_HOME environment variable) without regard to special characters such as carriage returns or linefeeds. When given a URL containing such special characters, extra headers could be inserted into the request.
This could cause scripts using Lynx to fetch data from the wrong site from servers with virtual hosting.

Users of Lynx are advised to upgrade to these erratum packages which contain a patch to correct this isssue.

ID	Name	Product	Family	Type	Severity
15047	Debian DSA-210-1 : lynx - CRLF injection	Nessus	Debian Local Security Checks	Local	medium
1736	Lynx Command Line URL CRLF Injection	Nessus Network Monitor	Web Clients		low
14008	Mandrake Linux Security Advisory : lynx (MDKSA-2003:023)	Nessus	Mandriva Local Security Checks	Local	medium
12357	RHEL 2.1 : lynx (RHSA-2003:030)	Nessus	Red Hat Local Security Checks	Local	medium

Detections

Analytics

CVE-2002-1405

medium

Tenable Plugins

medium

low

medium

medium