Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service (infinite loop) via a web page or HTML email that contains invalid HTML including (1) a TEXTAREA tag with a large COLS value and (2) a large tag name in an element that is not terminated, as demonstrated by mangleme. NOTE: a followup suggests that the relevant trigger for this issue is the large COLS value.

Several vulnerabilities have been discovered in lynx, the popular text-mode WWW browser. The Common Vulnerabilities and Exposures Project identifies the following vulnerabilities :

  - CVE-2004-1617     Michal Zalewski discovered that lynx is not able to grok     invalid HTML including a TEXTAREA tag with a large COLS     value and a large tag name in an element that is not     terminated, and loops forever trying to render the     broken HTML.

  - CVE-2005-3120     Ulf Harnhammar discovered a buffer overflow that can be     remotely exploited. During the handling of Asian     characters when connecting to an NNTP server lynx can be     tricked to write past the boundary of a buffer which can     lead to the execution of arbitrary code.

Michal Zalewski discovered that lynx, the popular text-mode WWW Browser, is not able to grok invalid HTML including a TEXTAREA tag with a large COLS value and a large tag name in an element that is not terminated, and loops forever trying to render the broken HTML. The same code is present in lynx-ssl.

Michal Zalewski discovered that lynx, the popular text-mode WWW Browser, is not able to grok invalid HTML including a TEXTAREA tag with a large COLS value and a large tag name in an element that is not terminated, and loops forever trying to render the broken HTML.

The remote host is using Lynx as a web browser. This version of Lynx is vulnerable to a buffer overflow when processing malformed NNTP headers.  An attacker exploiting this flaw would need to be able to convince the local Lynx user to browse a malicious NNTP server.  Successful exploitation will result in the attacker running arbitrary code on the local system.  

The remote host is using Lynx as a web browser. The version used is vulnerable to a remote attack wherein malformed HTML can cause Lynx to go into an infinite loop.  An attacker exploiting this flaw would need to be able to convince a user to browse to a malicious website.  Upon a successful attack, Lynx would take up many resources on the client machine, possibly causing a crash in either Lynx or the operating system.

ID	Name	Product	Family	Type	Severity
22627	Debian DSA-1085-1 : lynx-cur - several vulnerabilities	Nessus	Debian Local Security Checks	Local	high
22619	Debian DSA-1077-1 : lynx-ssl - programming error	Nessus	Debian Local Security Checks	Local	medium
22618	Debian DSA-1076-1 : lynx - programming error	Nessus	Debian Local Security Checks	Local	medium
3261	Lynx < 2.8.6 dev14 NNTP Headers Buffer Overflow	Nessus Network Monitor	Web Clients		medium
2581	Lynx Malformed HTML Tags DoS	Nessus Network Monitor	Web Clients		medium

Detections

Analytics

CVE-2004-1617

medium

Tenable Plugins

high

medium

medium

medium

medium