Stack-based buffer overflow in expires.c in Elm 2.5 PL5 through PL7, and possibly other versions, allows remote attackers to execute arbitrary code via an e-mail message with a long Expires header.

New Lynx packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue. An overflow could result in the execution of arbitrary code when using Lynx to connect to a malicious NNTP server.

Ulf Harnhammar discovered a remote buffer overflow in lynx versions 2.8.2 through 2.8.5.

When Lynx connects to an NNTP server to fetch information about the available articles in a newsgroup, it will call a function called HTrjis() with the information from certain article headers. The function adds missing ESC characters to certain data, to support Asian character sets. However, it does not check if it writes outside of the char array buf, and that causes a remote stack-based buffer overflow, with full control over EIP, EBX, EBP, ESI and EDI.

Two attack vectors to make a victim visit a URL to a dangerous news server are: (a) *redirecting scripts*, where the victim visits some web page and it redirects automatically to a malicious URL, and (b)
*links in web pages*, where the victim visits some web page and selects a link on the page to a malicious URL. Attack vector (b) is helped by the fact that Lynx does not automatically display where links lead to, unlike many graphical web browsers.

The updated packages have been patched to address this issue.

Update :

The previous patchset had a bug in the patches themselves, which was uncovered by Klaus Singvogel of Novell/SUSE in auditing crashes on some architectures.

The remote host is using Lynx as a web browser. This version of Lynx is vulnerable to a buffer overflow when processing malformed NNTP headers.  An attacker exploiting this flaw would need to be able to convince the local Lynx user to browse a malicious NNTP server.  Successful exploitation will result in the attacker running arbitrary code on the local system.  

An updated elm package is now available that fixes a buffer overflow issue for Red Hat Enterprise Linux 2.1 AS and AW.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Elm is a terminal mode email client.

A buffer overflow flaw in Elm was discovered that was triggered by viewing a mailbox containing a message with a carefully crafted 'Expires' header. An attacker could create a malicious message that would execute arbitrary code with the privileges of the user who received it. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2665 to this issue.

Users of Elm should update to this updated package, which contains a backported patch that corrects this issue.

The remote host is running Elm, an email client.  This version of Elm is vulnerable to a buffer overflow via the 'Expires' header parameter.  An attacker exploiting this flaw would send a specially formed email with a very long 'Expires' value.  Successful exploitation would result in arbitrary code being executed.

The remote host is using Lynx as a web browser. This version of Lynx is vulnerable to a buffer overflow when processing malformed NNTP headers.  An attacker exploiting this flaw would need to be able to convince the local Lynx user to browse a malicious NNTP server.  Successful exploitation will result in the attacker running arbitrary code on the local system.

ID	Name	Product	Family	Severity
54864	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : lynx (SSA:2005-310-03)	Nessus	Slackware Local Security Checks	high
20057	Mandrake Linux Security Advisory : lynx (MDKSA-2005:186-1)	Nessus	Mandriva Local Security Checks	high
3261	Lynx < 2.8.6 dev14 NNTP Headers Buffer Overflow	Nessus Network Monitor	Web Clients	medium
19544	RHEL 2.1 : elm (RHSA-2005:755)	Nessus	Red Hat Local Security Checks	high
3174	Elm 'Expires' Header Overflow	Nessus Network Monitor	SMTP Clients	medium
800974	Lynx < 2.8.6 dev14 NNTP Headers Buffer Overflow	Log Correlation Engine	Web Clients	medium
800109	Lynx < 2.8.6 dev14 NNTP Headers Buffer Overflow	Log Correlation Engine	Web Clients	medium

Detections

Analytics

CVE-2005-2665

critical

Tenable Plugins

high

high

medium

high

medium

medium

medium