Hi!

There was this posting on bugtraq about a lynx-problem. FreeBSD
disabled its port -- what do we do? Do we do something?

-- forwarded message --
From: lcamtuf@DIONE.IDS.PL (Michal Zalewski)
Subject: lynx - someone is deaf and blind ;)
Date: 28 Feb 2000 08:33:09 +0100
Message-ID: <Pine.LNX.4.21.0002271629490.15796-100000@dione.ids.pl>

Over six months ago, I've reported nasty and easily exploitable overflows
in lynx while parsing some URLs - like cso://AAAA... etc. I've given some
examples, and it was fixed, but then, month later, I've realized that
other protocols, not mentioned in previous post are still buggy in exactly
the same way. Another post resulted in patched lynx release. And what now,
guess?...

Similar problems are present for example when lynx is using proxy server
(often sysadm puts proxy server settings in global lynx.cfg) - even in
recent 2.8.3dev2x releases - http://AAA... or ftp://AAA... requests with
over 2 kb of junk after protocol indentifier (instead of valid hostname) -
0x41414141 SEGV - old, good, exploitable overflow while preparing request
for proxy server. AND MORE FOLLOWS - for example some overflows when
viewing 'Information about current document' and so on, all related to
extremely long URLs. I'm not going to give more examples here, as I'm
afraid I might miss one or two that won't be fixed - developers, use your
head, take a look at the code and fix every suspected piece of code, not
only already published / described bugs.

_______________________________________________________
Michal Zalewski * [lcamtuf@ags.pl] <=> [AGS WAN SYSADM]
[dione.ids.pl SYSADM] <-> [http://lcamtuf.na.export.pl]
[+48 22 551 45 93] [+48 603 110 160] bash$ :(){ :|:&};:
=-----=> God is real, unless declared integer. <=-----=

-- end of forwarded message --

-- 
Thomas Klausner - wiz@danbala.tuwien.ac.at
WWW-homepage: http://fbma.tuwien.ac.at/~e9325658/Welcome.html
Programming is like sex:
  One mistake and you have to support for a lifetime.