PT-2003-1028 · Lynx · Lynx

Published 2003-01-28 · Updated 2016-10-18 · CVE-2002-1405

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Lynx versions 2.8.4 and earlier

Description The issue allows remote attackers to inject false HTTP headers into an HTTP request, potentially leading to the disruption of protected information integrity. This can be achieved via a URL containing encoded carriage return, line feed, and other whitespace characters. The exploitation of this issue can be performed remotely.

Recommendations For Lynx versions 2.8.4 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-03456

BDU:2015-07925

BDU:2015-07926

CVE-2002-1405

DSA-210

Affected Products

Lynx

References · 21

• 🔥 https://exploit-db.com/exploits/21722 · Exploit
• http://redhat.com/support/errata/RHSA-2003-029.html · Vendor Advisory
• http://debian.org/security/2002/dsa-210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1405 · Security Note
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:023 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07926 · Security Note
• https://bdu.fstec.ru/vul/2015-07925 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1405 · Vendor Advisory
• http://trustix.net/errata/misc/2002/TSL-2002-0085-lynx-ssl.asc.txt · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-1405 · Vendor Advisory
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-049.0.txt · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1405 · Security Note
• https://bdu.fstec.ru/vul/2015-03456 · Security Note
• http://iss.net/security_center/static/9887.php · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-030.html · Vendor Advisory