Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme. NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.

Several vulnerabilities have been discovered in lynx, the popular text-mode WWW browser. The Common Vulnerabilities and Exposures Project identifies the following vulnerabilities :

  - CVE-2004-1617     Michal Zalewski discovered that lynx is not able to grok     invalid HTML including a TEXTAREA tag with a large COLS     value and a large tag name in an element that is not     terminated, and loops forever trying to render the     broken HTML.

  - CVE-2005-3120     Ulf Harnhammar discovered a buffer overflow that can be     remotely exploited. During the handling of Asian     characters when connecting to an NNTP server lynx can be     tricked to write past the boundary of a buffer which can     lead to the execution of arbitrary code.

Michal Zalewski discovered that lynx, the popular text-mode WWW Browser, is not able to grok invalid HTML including a TEXTAREA tag with a large COLS value and a large tag name in an element that is not terminated, and loops forever trying to render the broken HTML. The same code is present in lynx-ssl.

Michal Zalewski discovered that lynx, the popular text-mode WWW Browser, is not able to grok invalid HTML including a TEXTAREA tag with a large COLS value and a large tag name in an element that is not terminated, and loops forever trying to render the broken HTML.

The remote host is using Lynx as a web browser. This version of Lynx is vulnerable to a buffer overflow when processing malformed NNTP headers.  An attacker exploiting this flaw would need to be able to convince the local Lynx user to browse a malicious NNTP server.  Successful exploitation will result in the attacker running arbitrary code on the local system.  

The remote host is using Lynx as a web browser. The version used is vulnerable to a remote attack wherein malformed HTML can cause Lynx to go into an infinite loop.  An attacker exploiting this flaw would need to be able to convince a user to browse to a malicious website.  Upon a successful attack, Lynx would take up many resources on the client machine, possibly causing a crash in either Lynx or the operating system.

The remote host is using Lynx as a web browser. This version of Lynx is vulnerable to a buffer overflow when processing malformed NNTP headers.  An attacker exploiting this flaw would need to be able to convince the local Lynx user to browse a malicious NNTP server.  Successful exploitation will result in the attacker running arbitrary code on the local system.

ID	Name	Product	Family	Severity
22627	Debian DSA-1085-1 : lynx-cur - several vulnerabilities	Nessus	Debian Local Security Checks	high
22619	Debian DSA-1077-1 : lynx-ssl - programming error	Nessus	Debian Local Security Checks	medium
22618	Debian DSA-1076-1 : lynx - programming error	Nessus	Debian Local Security Checks	medium
3261	Lynx < 2.8.6 dev14 NNTP Headers Buffer Overflow	Nessus Network Monitor	Web Clients	medium
2581	Lynx Malformed HTML Tags DoS	Nessus Network Monitor	Web Clients	medium
800979	Lynx Malformed HTML Tags DoS	Log Correlation Engine	Web Clients	medium
800974	Lynx < 2.8.6 dev14 NNTP Headers Buffer Overflow	Log Correlation Engine	Web Clients	medium
800109	Lynx < 2.8.6 dev14 NNTP Headers Buffer Overflow	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2004-1617

medium

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium