Lynx 2.8 Buffer Overflow Vulnerability
BID:100
Info
Lynx 2.8 Buffer Overflow Vulnerability
| Bugtraq ID: | 100 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | Unknown |
| Published: | May 03 1998 12:00AM |
| Updated: | May 03 1998 12:00AM |
| Credit: | This vulnerability was published on the BugTraq mailing list by Michal Zalewski <[email protected]> on Sun, 3 May 1998. |
| Vulnerable: |
University of Kansas Lynx 2.8 |
| Not Vulnerable: | |
Discussion
Lynx 2.8 Buffer Overflow Vulnerability
There exists a buffer overflow in Lynx's built-in mailer that can be exploited when when the victim tries to follow a hyperlink. Lynx makes blind assumption on e-mail address length, and sprintfs it into 512-bytes long buffer. The vulnerability is in LMail.c as part of the processing of "mailto:" URLs.
There exists a buffer overflow in Lynx's built-in mailer that can be exploited when when the victim tries to follow a hyperlink. Lynx makes blind assumption on e-mail address length, and sprintfs it into 512-bytes long buffer. The vulnerability is in LMail.c as part of the processing of "mailto:" URLs.
Exploit / POC
Lynx 2.8 Buffer Overflow Vulnerability
<a href="mailto:AAAAAAAAA[...about 3 kB...]AAAA">MAIL ME!</a>
(you should use over 2 kB of 'A's, because there are also other small
buffers on lynx's stack at the time)
<a href="mailto:AAAAAAAAA[...about 3 kB...]AAAA">MAIL ME!</a>
(you should use over 2 kB of 'A's, because there are also other small
buffers on lynx's stack at the time)
Solution / Fix
Lynx 2.8 Buffer Overflow Vulnerability
Solution:
Fix: replace sprintf with snprintf.
Upgrade to Lynx 2.8.1dev 10 or later.
Solution:
Fix: replace sprintf with snprintf.
Upgrade to Lynx 2.8.1dev 10 or later.
References
Lynx 2.8 Buffer Overflow Vulnerability
References:
References: