[Lynx-dev] Possible more elegant fix for Lynx vulnerability?

[Naveen Albert]

Hello,

   I've written up a whitepaper about a vulnerability with default Lynx 
configurations that could allow anonymous users potentially privilege 
escalate and compromise a machine: 
https://public.interlinked.us/3/lynx-filesystem

It may have been discovered before. I independently discovered it as 
have multiple others.It's been actively exploited in the wild before. 
This attack has been successfully used to completely compromise the root 
accounts of machines, and in one case resulted in irreversible data loss.

While it's not really a flaw with Lynx itself, but rather just poor 
security practices in general, as I'm sure you'll point out, I'm 
wondering if there's a more elegant way that this "loophole" with Lynx 
might get patched.

I'm sure this wasn't the intent, but Lynx is getting used this way and 
people's machines are getting p0wned, so it might be worth looking into 
- or maybe not. Just bringing this to your attention, if you feel it's 
worth addressing.

Thanks!

NA