CVE-2016-9179 Server-side request forgery in n/a

High 7.5 Published 22 Dec 2016 Updated 6 Aug 2024

An attacker can trick Lynx into connecting to a different host by manipulating URL parsing, bypassing intended destination restrictions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-9179?

CVE-2016-9179 is a high-severity server-side request forgery vulnerability in n/a, published on 22 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

lynx: It was found that Lynx doesn't parse the authority component of the URL correctly when the host name part ends with '?', and could instead be tricked into connecting to a different host.

Weakness: CWE-20

Which versions are affected by CVE-2016-9179?

It affects 1 product.

Linux distribution packages (1)

lynx SUSE:Linux Enterprise Software Development Kit 11 SP4 All versions 2.8.6-145.1

Products include Lynx Lynx.

How do I fix CVE-2016-9179?

Apply the vendor's patch.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2016-9179 being exploited?

There is no known exploitation of CVE-2016-9179 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2016-9179, DLA-719-1, GHSA-r2wx-qjhc-7h6p, MGASA-2017-0052, MINI-r5c8-43xx-7h5j, SUSE-SU-2017:0599-1 and 1 more.