CERT-In Vulnerability Note
CIVN-2005-0105
Lynx 'HTrjis' NNTP Remote Buffer Overflow Vulnerability
Original Issue Date:October 20, 2005
Severity Rating: HIGH
Systems Affected
Lynx 2.x
Overview
A buffer overflow vulnerability has been identified in Lynx 2.x, which could be exploited by remote attackers to compromise the system.
Description
Lynx is a text browser for the World Wide Web. It has been observed that a buffer overflow vulnerability exists in the "HTrjis " function of HTMIME.c that does not properly validate specially crafted NNTP Network News Transfer Protocol article headers. This can be exploited remotely to cause a stack based buffer overflow by manipulating the user to visit a malicious website which redirects to a malicious NNTP server.
Successful exploitation of this vulnerability may allow a remote user to execute arbitrary commands.
Solution
Upgrade to Lynx version 2.8.6dev.14 :
http://lynx.isc.org/
Vendor Information
http://lynx.isc.org/
References
Secunia
http://secunia.com/advisories/17216/
SecurityTracker
http://www.securitytracker.com/alerts/2005/Oct/1015065.html
CVE Name
CAN-2005-3120
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-2436857
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|