[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

lynx-dev Lynx CRLF Injection (fwd)

From: Ulf Harnhammar
Subject: lynx-dev Lynx CRLF Injection (fwd)
Date: Mon, 19 Aug 2002 21:43:41 +0200 (CEST)

I have posted a security advisory about the recent security hole in Lynx
to the Bugtraq and VulnWatch mailing lists.

// Ulf Harnhammar

---------- Forwarded message ----------
Date: Mon, 19 Aug 2002 02:17:04 +0200 (CEST)
From: Ulf Harnhammar <address@hidden>
To: address@hidden
Subject: Lynx CRLF Injection

Lynx CRLF Injection

VENDOR: Lynx-Dev List <address@hidden>
VULNERABLE VERSIONS: 2.8.4rel.1, 2.8.5dev.8, 2.8.3rel.1, 2.8.2rel.1,
                     possibly others
IMMUNE VERSIONS: 2.8.4rel.1 with all patches applied
SEVERITY: medium


"Lynx is a fully-featured World Wide Web (WWW) client for users
running cursor-addressable, character-cell display devices such
as vt100 terminals, vt100 emulators running on Windows 95/NT or
Macintoshes, or any other character-cell display.  It will display
Hypertext Markup Language (HTML) documents containing links to files
on the local system, as well as files on remote systems running
http, gopher, ftp, wais, nntp, finger, or cso/ph/qi servers, and
services accessible via logins to telnet, tn3270 or rlogin accounts.
Current versions of Lynx run on Unix, VMS, Windows95/NT, 386DOS
and OS/2 EMX."

(direct quote from the program's README file)

Lynx is published under the terms of the GNU General Public License.
It is a very common program (I personally have used it since 1995),
but this hole will only affect some of its users.


If you give Lynx a URL with some special characters on the command
line, it will include faked headers in the HTTP query. This way,
you can make scripts that use Lynx for downloading files access
the wrong site on a web server with multiple virtual hosts.


When a URL is given on the command line or in the WWW_HOME
environment variable, Lynx doesn't remove or encode dangerous
characters such as space, tab, CR and LF before constructing HTTP
queries. This means that an attacker can construct a URL that will
send arbitrary faked HTTP headers, by adding space + "HTTP/1.0" +
CRLF + some headers + CRLF + CRLF after the normal URL. Lynx's own
HTTP headers are sent after the faked headers, but the web server
ignores them, as our CRLF + CRLF pair above indicates the end of
the headers.

This may cause some security problems. One scenario is when a
program starts Lynx, and the host part of the URL is supplied
by the program and the path by its user (something like "lynx$path";, where the value of $path is defined by
the user). An attacker can make such a program access some other web
site than, if it's a virtual host on the same machine
as, by adding a "Host:" header as described above.

Relative links don't work in web pages that are fetched this way. If
there is a relative link like  <a href="sunnanvind.html">Sunnan</a>
and the user follows it, Lynx gets confused.

To get more information about this type of hole,
read my paper "CRLF Injection", which is available at


#!/usr/bin/perl --
# Ulf Harnhammar 2002
# example: ./exploit
# will show

die "$0 hostone hosttwo\n" if @ARGV != 2;

exec('lynx "'.
     "http://$ARGV[0]/ HTTP/1.0\012".
     "Host: $ARGV[1]\012\012".


(This exploit assumes that and are virtual
hosts on the same machine. Lynx will show

address@hidden ulf]$ lynx " HTTP/1.0



The vendor was contacted on the 13th of August. Their patch was
released and announced on the Lynx-Dev list on the 18th.

// Ulf Harnhammar

; To UNSUBSCRIBE: Send "unsubscribe lynx-dev" to address@hidden

reply via email to

[Prev in Thread] Current Thread [Next in Thread]