H-82: Lynx Temporary Files & LYDownload.c Vulnerabilities

PROBLEM:       Two vulnerabilities exist for Lynx: 1) temporary files, and 2) 
               LYDownload.c. 
PLATFORM:      All Unix or Unix-like systems running Lynx up to and including 
               version 2.7.1 
DAMAGE:        1) May allow local users to gain root privileges. 
               2) This vulnerability may be exploited by anyone who can provide
                  Lynx a carefully crafted URL.
                
SOLUTION:      Apply patches or workarounds listed below. 
VULNERABILITY  Exploit details involving these vulnerabilities have been made 
ASSESSMENT:    publicly available. 


[ Start CERT Advisories ]

1) Temporary Files

=============================================================================
CERT* Vendor-Initiated Bulletin VB-97.05
July 15, 1997

Topic:   Vulnerability in Lynx Temporary Files
Source:  Jim Spath

To aid in the wide distribution of essential security information, the CERT
Coordination Center is forwarding the following information from Jim Spath,
who coordinated this bulletin with several members of the lynx-dev mailing
list. They urge you to act on this information as soon as possible. 
information is included in the forwarded text below; please contact them if
you have any questions or need further information.

Questions about the bulletin only can be sent to Jim Spath
jspath@mail.bcpl.lib.md.us; questions about Lynx can be sent to
lynx-dev@sig.net.

=======================FORWARDED TEXT STARTS HERE============================

I. Description

Lynx typically stores persistent temporary files in /tmp on Un*x
systems.  The filenames Lynx chooses can be predicted, and another
user on the system may be able to exploit a race condition to replace
the temporary file with a symbolic link or with another file.

Installed versions of Lynx where a directory writeable by other users
(such as /tmp on a machine to which multiple users have access) is used
to store files during download are vulnerable.  This vulnerability can
only be exploited by a user with access to an account on the machine
running Lynx.


II. Impact

A malicious user with access to the same machine as other Lynx users
may be able to cause another user's Lynx process to overwrite another
file.  It may also be possible to replace the contents of a downloaded
file with a file other than the one the user downloaded, or to cause
the user to print a file other than the one selected for printing.


III.  Workarounds

A workaround for Lynx 2.7.1 is described in the "solutions" section
below.


IV.  Solutions

There are several ways to solve this problem.

A. The best solution to the problem is to apply the FOTEMODS patch
   set and to ensure that /tmp/ on your system is a "sticky directory."

   If you cannot apply this patch set, if your system does not support
   sticky directories, or if you cannot make /tmp/ a sticky directory,
   you must use one of the other solutions below.

B. The other solution to this problem is to change the setting
   of TEMP_SPACE from the default ("/tmp/") to non-world-writeable
   directories.

   To do this with unpatched Lynx version 2.7.1:

     1. Lynx can be rebuilt with the "#define TEMP_SPACE" in
        lynx2-7-1/userdefs.h changed from "/tmp" to point to a
        directory only writeable by the user executing Lynx.

     2. The LYNX_TEMP_SPACE environment variable may be set before
        shell startup files (.profile, .cshrc, or equivalent) or into
        the system profile (/etc/profile or equivalent).

     As an aid to allowing Lynx to find user-specific temp. directories,
     Lynx 2.7.1 will replace "~" in the temp. space allocation with the
     path to the user's home directory.

     Individual users may also set the LYNX_TEMP_SPACE environment
     variable to point to another place known to be unwriteable by other
     users (for instance a subdirectory of the users' home directory, or a
     mode 0700 directory of a "sticky" /tmp).

   To do this with Lynx 2.7.1 with the FOTEMODS patch set applied:

     You may use any of the methods listed for "vanilla" Lynx 2.7.1.
     You may also use "$USER" in TEMP_SPACE (or $LYNX_TEMP_SPACE) to
     specify user-specific temp. directories such as /tmp/$USER/.


The FOTEMODS patch set includes the changes described above as well
as other fixes and feature enhancements.  It can be found at:
     http://www.slcc.edu/lynx/fote/patches/


The FOTEMODS patches avoid any pre-existing filenames for new temporary
files, thus skipping any symbolic link which may have been created with
an upcoming temporary filename.  These patches also allow the administrator
or user to define TEMP_SPACE (or the LYNX_TEMP_SPACE environment variable)
as "/tmp/$USER" (for example) for pre-existing directories that correspond
to accounts' usernames and have protections/ACLs set for access only by
the appropriate users.

This patch set also does chmod(600) for temporary files which Lynx
creates, but the account should be set up with an equivalent umask
before invoking Lynx.

C. One other solution (a source code patch) for this problem, by Klaus
   Weide, can be found at:
        http://www.slcc.edu/lynx/klaus/temp/
   However, this patch should be considered "alpha" quality code, and
   its author is not supporting it at this time.


The next release of Lynx will eliminate this vulnerability.  Interested
parties should subscribe to and read the LYNX-DEV mailing list
(send mail to majordomo@sig.net with "subscribe lynx-dev" as the
body) for information about this release.


V. Contact information

If you believe you have found a security problem with the current
version of Lynx, we urge you to forward it to the LYNX-DEV
mailing list at lynx-dev@sig.net.  

The LYNX-DEV mailing list (with further information about this
vulnerability) is archived at:
     http://www.flora.org/lynx-dev/

Lynx security information is available at:
     http://www.crl.com/~subir/lynx/security.html

General information about Lynx is available at:
     http://lynx.browser.org/

On-line help and documentation about Lynx is available using the
(h)elp command. More help is available in the source distribution.
Should your questions not be answered by these means, further
questions may be directed to help@lynx.browser.org.

Please don't contact Lynx developers personally about Lynx-related
issues; please use either the mailing list or the "help" addresses
given above.


========================FORWARDED TEXT ENDS HERE=============================


2) LYDownload.c 

=============================================================================
CERT* Vendor-Initiated Bulletin VB-97.06
July 15, 1997

Topic:   Vulnerability in Lynx Downloading
Source:  Jim Spath

To aid in the wide distribution of essential security information, the CERT
Coordination Center is forwarding the following information from Jim Spath,
who coordinated this bulletin with several members of the lynx-dev mailing
list. They urge you to act on this information as soon as possible. Contact
information is included in the forwarded text below; please contact them if
you have any questions or need further information.

Questions about the bulletin only can be sent to Jim Spath
jspath@mail.bcpl.lib.md.us; questions about Lynx can be sent to
lynx-dev@sig.net.

=======================FORWARDED TEXT STARTS HERE============================

I. Description

Lynx, on Un*x systems, may be coerced to read or execute arbitrary
files on the local system regardless of restrictions set by the
system administrator.

Installed versions of Lynx up to and including version 2.7.1 on Unix
or Unix-like operating systems are vulnerable.


II. Impact

A. Captive Lynx installations

   Users of Lynx in a captive situation (where the Lynx user does not
   normally have access to a shell prompt, or to a menu system that allows
   the user to run arbitrary commands) can get access to a shell prompt.
   This includes public Lynxes as well as any setup where the user
   is restricted as to which programs can be run.

B. All Lynx installations

   This vulnerability could also conceivably allow malicious webmasters to
   add these carefully crafted URLs to their pages to cause unsuspecting
   Lynx users (in captive accounts or otherwise) to execute arbitrary 
commands.

   This vulnerability can be exploited by anyone who can provide Lynx a
   carefully crafted URL.

III. Workaround

If administrators of captive Lynxes cannot apply the code patches or
obtain updated binaries as described below, they are advised to disable
(g)oto on Lynx.

There is currently no workaround for impact "B" above.  The code patches
below must be applied (or updated binaries obtained) to eliminate
this impact.


IV. Solution

Current developmental releases of Lynx have fixed this problem since
1997-06-26.  Patches you may find from before that date may not
entirely eliminate the vulnerability.

The most recent stable version of Lynx (version 2.7.1) can be
patched to fix this problem by replacing the file "lynx2-7-1/src/LYDownload.c"
with a replacement file.

The replacement file to eliminate this vulnerability in version
2.7.1 is available (courtesy of Foteos Macrides) at:
     http://www.slcc.edu/lynx/fote/patches/lynx2-7-1/src/LYDownload.c

All systems running Lynx versions 2.7.1 or earlier should be
updated to fix this problem.

Two development branches of the Lynx source code are available at:
     http://www.slcc.edu/lynx/fote/patches/
     http://www.slcc.edu/lynx/current/

Binary distributions of Lynx may be found at:
     

Note that producing binaries is a volunteer job and the latest (or any)
version may not be available for a specific platform.


V. Contact information

If you believe you have found a security problem with the current
version of Lynx, we urge you to forward it to the LYNX-DEV
mailing list at lynx-dev@sig.net.

The LYNX-DEV mailing list (with further information about this
vulnerability) is archived at:
     http://www.flora.org/lynx-dev/

Lynx security information is available at:
     http://www.crl.com/~subir/lynx/security.html

General information about Lynx is available at:
     http://lynx.browser.org/

On-line help and documentation about Lynx is available using the
(h)elp command. More help is available in the source distribution.
Should your questions not be answered by these means, further
questions may be directed to help@lynx.browser.org.

Please don't contact Lynx developers personally about Lynx-related
issues; please use either the mailing list or the "help" addresses
given above.

========================FORWARDED TEXT ENDS HERE=============================

[ End CERT Advisories ]

    Voice:          +1 925-422-8193 (7 x 24)
    FAX:            +1 925-423-8002
    STU-III:        +1 925-423-2604
    E-mail:          ciac@ciac.org
    World Wide Web:  http://www.ciac.org/
    Anonymous FTP:   ftp.ciac.org