3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
111 lines
3.9 KiB
Text
111 lines
3.9 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-00:08 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: Lynx ports contain numerous buffer overflows
|
|
|
|
Category: ports
|
|
Module: lynx/lynx-current/lynx-ssl/ja-lynx/ja-lynx-current
|
|
Announced: 2000-03-15
|
|
Revised: 2000-05-17
|
|
Affects: Ports collection before the correction date.
|
|
Corrected: 2000-04-16 [lynx-current]
|
|
2000-04-21 [lynx]
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
Lynx is a popular text-mode WWW browser, available in several versions
|
|
including SSL support and Japanese language localization.
|
|
|
|
II. Problem Description
|
|
|
|
Versions of the lynx software prior to version 2.8.3pre.5 were written
|
|
in a very insecure style and contain numerous potential and several
|
|
proven security vulnerabilities (publicized on the BugTraq mailing
|
|
list) exploitable by a malicious server.
|
|
|
|
The lynx ports are not installed by default, nor are they "part of
|
|
FreeBSD" as such: they are part of the FreeBSD ports collection, which
|
|
contains over 3200 third-party applications in a ready-to-install
|
|
format.
|
|
|
|
FreeBSD makes no claim about the security of these third-party
|
|
applications, although an effort is underway to provide a security
|
|
audit of the most security-critical ports.
|
|
|
|
III. Impact
|
|
|
|
A malicious server which is visited by a user with the lynx browser
|
|
can exploit the browser security holes in order to execute arbitrary
|
|
code as the local user.
|
|
|
|
If you have not chosen to install any of the
|
|
lynx/lynx-current/lynx-ssl/ja-lynx/ja-lynx-current ports/packages,
|
|
then your system is not vulnerable.
|
|
|
|
IV. Workaround
|
|
|
|
Remove the lynx/lynx-current/lynx-ssl/ja-lynx/ja-lynx-current ports,
|
|
if you you have installed them.
|
|
|
|
V. Solution
|
|
|
|
Upgrade to lynx or lynx-current after the correction date.
|
|
|
|
After the initial release of this advisory, the Lynx development team
|
|
conducted an audit of the source code, and have corrected the known
|
|
vulnerabilities in lynx as well as increasing the robustness of the
|
|
string-handling code. As of lynx-2.8.3pre.5, we consider it safe
|
|
enough to use again.
|
|
|
|
Note that there may be undiscovered vulnerabilities remaining in the
|
|
code, as with all software - but should any further vulnerabilities be
|
|
discovered a new advisory will be issued.
|
|
|
|
At this time the lynx-ssl/ja-lynx/ja-lynx-current ports are not yet
|
|
updated to a safe version of lynx: this advisory will be reissued
|
|
again once they are.
|
|
|
|
1) Upgrade your entire ports collection and rebuild the lynx or
|
|
lynx-current port.
|
|
|
|
2) Reinstall a lynx new package dated after the correction date,
|
|
obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/www/lynx-2.8.3.1.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/www/lynx-2.8.3.1.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/www/lynx-2.8.3.1.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/www/lynx-2.8.3.1.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/www/lynx-2.8.3.1.tgz
|
|
|
|
Note that the lynx-current port is not automatically built as a package.
|
|
|
|
3) download a new port skeleton for the lynx/lynx-current port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
4) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/ports/packages/devel/portcheckout-1.0.tgz
|
|
|
|
VI. Revision History
|
|
|
|
v1.0 2000-03-15 Initial release
|
|
v1.1 2000-05-17 Update to note fix of lynx and lynx-current ports.
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBOSMQT1UuHi5z0oilAQHlgwP9EiLqvf8MM55fvftEXPMfL6PJ6HFQPYMH
|
|
+TqX5Q/P9s0mgBFiGfN8wblmtEUyZ1GwF8goPa9fqqJIfNg8Qu2zWqJOYPjc20hW
|
|
yo3Rxbi+lEWOYxLpxBKDhvBH7yWxiV8Nm1+w73a76BjaZ20E0b91hgw2lebFiZPi
|
|
uzK38WjnFNQ=
|
|
=qWEC
|
|
-----END PGP SIGNATURE-----
|