Re: lynx-dev Potential security hole?

[T.E.Dickey]

> Hi there... 
>  
> I've just run across an announcement of a security hole in lynx. The 
> site that announced it doesn't appear to be offering the source patch to 
> fix it, and they don't appear to have an AIX binary. I can't find any 
> reference to it on the lynx pages, and our site is vulnerable. Have you 
> been notified of this bug, and if so, is there a patch that I can 
> download to fix it? Thanks in advance... 

*** lynx2-8-2.old/WWW/Library/Implementation/HTTCP.c    Tue Jul 20 02:19:59 
1999 
--- lynx2-8-2/WWW/Library/Implementation/HTTCP.c        Mon Aug 30 13:08:47 
1999 
*************** 
*** 314,319 **** 
--- 314,320 ---- 
  **  - contains only valid chars for domain names (actually, the 
  **    restrictions are somewhat relaxed), 
  **  - no leading dots or empty segments, 
+ **  - no segment starts with '-' or '+' [this protects telnet command], 
  **  - max. length of dot-separated segment <= 63 (RFC 1034,1035), 
  **  - total length <= 254 (if it ends with dot) or 253 (otherwise) 
  **     [an interpretation of RFC 1034,1035, although RFC 1123 
*************** 
*** 341,346 **** 
--- 342,349 ---- 
                iseg = 0; 
                continue; 
            } 
+       } else if (iseg == 0 && (*cp == '-' || *cp == '+')) { 
+           return NO; 
        } else if (++iseg > 63) { 
                return NO; 
        } 
 

-- 
Thomas E. Dickey
address@hidden
http://www.clark.net/pub/dickey