Skip to Content.
Sympa Menu

sm-security - [SM-Security] lynx: buffer overflow

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <thomas.houssin AT gmail.com>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] lynx: buffer overflow
  • Date: Sun, 13 Nov 2005 23:51:43 +0100

Synopsis
========
A stack-based buffer overflow was reported in the HTrjis function in lynx.

Background
==========
Lynx is a fully-featured World Wide Web (WWW) client for users running
cursor-addressable, character-cell display devices (e.g., vt100
terminals, vt100 emulators running on PCs or Macs, or any other
character-cell display).

Description
===========
CAN-2005-3120:
Stack-based buffer overflow in the HTrjis function in lynx allows remote
NNTP servers to execute arbitrary code via certain article headers
containing Asian characters that cause Lynx to add extra escape (ESC)
characters.

Impact
======
An attacker could setup a malicious NNTP server and entice a user to
access it using Lynx (for example by creating NNTP links on a web page).
The data returned by the NNTP server would trigger the buffer overflow
and execute arbitrary code with the rights of the user running Lynx.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
This is now fixed in all grimoires.

Resolution
==========
All lynx users should upgrade to the latest available version:
# scribe update
# cast -c lynx

References
==========
[ 1 ] CAN-2005-3120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3120
[ 2 ] GLSA 200510-15
http://www.gentoo.org/security/en/glsa/glsa-200510-15.xml

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36


Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] lynx: buffer overflow, Thomas Houssin, 11/13/2005

Archive powered by MHonArc 2.6.24.

Top of Page