Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 27 Oct 2008 18:38:19 +0000
From: Tavis Ormandy <taviso@....lonestar.org>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request: lynx (old) .mailcap handling flaw

On Sat, Oct 25, 2008 at 08:27:51PM +0200, Tomas Hoger wrote:
> Hi Steven!
> 
> There's one old lynx issue that seem to need a 2006 CVE id.  lynx
> browser prior to 2.8.6rel.4 tries to open mailcap and mime type
> definition files form the current directory.  If user can be convinced
> to run lynx in a specially crafted directory, an attacker controlling
> the directory may be able to run arbitrary code as the victim running
> lynx.

That reminds me, I recently noticed valgrind also does this.

$ printf -- "--db-command=/usr/bin/id\n--db-attach=yes\n" > /tmp/.valgrindrc

Etc.

Thanks, Tavis.

-- 
-------------------------------------
taviso@....lonestar.org | finger me for my gpg key.
-------------------------------------------------------

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.