LYNX-DEV Lynx 2.6

[Bob Tanner]

>>     My administrator has disabled lynx 2.6 and will not put any version
>>  of lynx on the system because he said all versions of lynx have a
>>  bug that will allow root access. Is this true? Thank you.
>  
>This sounds more severe than any vulnerability that we are aware of.
>
>Please ask your administrator to post to address@hidden
>describing what he considers to be the attack to which Lynx makes
>him vulnerable.
>
>--
>Al Gilman

I am the administrator that disabled lynx. Please see the folling URLs
from the BUGTRAQ mailing list archive.

http://www.geek-girl.com/bugtraq/1997_2/0174.html
http://www.geek-girl.com/bugtraq/1997_2/0176.html
http://www.geek-girl.com/bugtraq/1997_2/0180.html

A difficult hack, but doable. I run a (swatch) that sits a looks for
patterns in text files (mostly /var/log/syslog) and notifies admins if
there is any thing of interest. I also run swatch on output from
snoop. One of the things I swatch for is the keywork rhost, so I know
if/when someone legitly or maliciously alters their .rhosts file.

Won't you know it about 4 hours after I got this email I got hits on 3
.rhosts files. Now, I could not verify if it was lynx doing it
(hunders of users online makes the difficult) but I am a paranoid
individual and disabled lynx. I am might be overly paranoid.

As the/a author of the software can you validate/discredit my concerns? 
Nothing else was said on the BUGTRAQ list as of yet.

Thanks.


-- 
Bob Tanner <address@hidden>       | Phone : 612.943.8700
http://www.real-time.com                | Fax   : 612.943.8300
Key fingerprint =  6C E9 51 4F D5 3E 4C 66  62 A9 10 E5 35 85 39 D9 

;
; To UNSUBSCRIBE:  Send a mail message to address@hidden
;                  with "unsubscribe lynx-dev" (without the
;                  quotation marks) on a line by itself.
;