-----BEGIN PGP SIGNED MESSAGE-----

=============================================================================
CERT* Vendor-Initiated Bulletin VB-97.05
July 15, 1997

Topic:   Vulnerability in Lynx Temporary Files
Source:  Jim Spath

To aid in the wide distribution of essential security information, the CERT
Coordination Center is forwarding the following information from Jim Spath,
who coordinated this bulletin with several members of the lynx-dev mailing
list. They urge you to act on this information as soon as possible.
information is included in the forwarded text below; please contact them if
you have any questions or need further information.

Questions about the bulletin only can be sent to Jim Spath
<jspath@mail.bcpl.lib.md.us>; questions about Lynx can be sent to
<lynx-dev@sig.net>.

=======================FORWARDED TEXT STARTS HERE============================

I. Description

Lynx typically stores persistent temporary files in /tmp on Un*x
systems.  The filenames Lynx chooses can be predicted, and another
user on the system may be able to exploit a race condition to replace
the temporary file with a symbolic link or with another file.

Installed versions of Lynx where a directory writeable by other users
(such as /tmp on a machine to which multiple users have access) is used
to store files during download are vulnerable.  This vulnerability can
only be exploited by a user with access to an account on the machine
running Lynx.


II. Impact

A malicious user with access to the same machine as other Lynx users
may be able to cause another user's Lynx process to overwrite another
file.  It may also be possible to replace the contents of a downloaded
file with a file other than the one the user downloaded, or to cause
the user to print a file other than the one selected for printing.


III.  Workarounds

A workaround for Lynx 2.7.1 is described in the "solutions" section
below.


IV.  Solutions

There are several ways to solve this problem.

A. The best solution to the problem is to apply the FOTEMODS patch
   set and to ensure that /tmp/ on your system is a "sticky directory."

   If you cannot apply this patch set, if your system does not support
   sticky directories, or if you cannot make /tmp/ a sticky directory,
   you must use one of the other solutions below.

B. The other solution to this problem is to change the setting
   of TEMP_SPACE from the default ("/tmp/") to non-world-writeable
   directories.

   To do this with unpatched Lynx version 2.7.1:

     1. Lynx can be rebuilt with the "#define TEMP_SPACE" in
        lynx2-7-1/userdefs.h changed from "/tmp" to point to a
        directory only writeable by the user executing Lynx.

     2. The LYNX_TEMP_SPACE environment variable may be set before
        shell startup files (.profile, .cshrc, or equivalent) or into
        the system profile (/etc/profile or equivalent).

     As an aid to allowing Lynx to find user-specific temp. directories,
     Lynx 2.7.1 will replace "~" in the temp. space allocation with the
     path to the user's home directory.

     Individual users may also set the LYNX_TEMP_SPACE environment
     variable to point to another place known to be unwriteable by other
     users (for instance a subdirectory of the users' home directory, or a
     mode 0700 directory of a "sticky" /tmp).

   To do this with Lynx 2.7.1 with the FOTEMODS patch set applied:

     You may use any of the methods listed for "vanilla" Lynx 2.7.1.
     You may also use "$USER" in TEMP_SPACE (or $LYNX_TEMP_SPACE) to
     specify user-specific temp. directories such as /tmp/$USER/.


The FOTEMODS patch set includes the changes described above as well
as other fixes and feature enhancements.  It can be found at:
     http://www.slcc.edu/lynx/fote/patches/


The FOTEMODS patches avoid any pre-existing filenames for new temporary
files, thus skipping any symbolic link which may have been created with
an upcoming temporary filename.  These patches also allow the administrator
or user to define TEMP_SPACE (or the LYNX_TEMP_SPACE environment variable)
as "/tmp/$USER" (for example) for pre-existing directories that correspond
to accounts' usernames and have protections/ACLs set for access only by
the appropriate users.

This patch set also does chmod(600) for temporary files which Lynx
creates, but the account should be set up with an equivalent umask
before invoking Lynx.

C. One other solution (a source code patch) for this problem, by Klaus
   Weide, can be found at:
        http://www.slcc.edu/lynx/klaus/temp/
   However, this patch should be considered "alpha" quality code, and
   its author is not supporting it at this time.


The next release of Lynx will eliminate this vulnerability.  Interested
parties should subscribe to and read the LYNX-DEV mailing list
(send mail to majordomo@sig.net with "subscribe lynx-dev" as the
body) for information about this release.


V. Contact information

If you believe you have found a security problem with the current
version of Lynx, we urge you to forward it to the LYNX-DEV
mailing list at <lynx-dev@sig.net>.

The LYNX-DEV mailing list (with further information about this
vulnerability) is archived at:
     http://www.flora.org/lynx-dev/

Lynx security information is available at:
     http://www.crl.com/~subir/lynx/security.html

General information about Lynx is available at:
     http://lynx.browser.org/

On-line help and documentation about Lynx is available using the
(h)elp command. More help is available in the source distribution.
Should your questions not be answered by these means, further
questions may be directed to <help@lynx.browser.org>.

Please don't contact Lynx developers personally about Lynx-related
issues; please use either the mailing list or the "help" addresses
given above.


========================FORWARDED TEXT ENDS HERE=============================

The CERT Coordination Center staff thanks Aaron of Internet Maine for
reporting the problem and thanks Jim Spath and his lynx-dev colleagues for
their cooperation in developing this bulletin.

- -------------------------------------------------------------------------
If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (FIRST). See http://www.first.org/team-info/.

We strongly urge you to encrypt any sensitive information you send by email.
The CERT Coordination Center can support a shared DES key and PGP. Contact
the CERT staff for more information.

Location of CERT PGP key
         ftp://info.cert.org/pub/CERT_PGP.key


CERT Contact Information
- ------------------------
Email    cert@cert.org

Phone    +1 412-268-7090 (24-hour hotline)
                CERT personnel answer 8:30-5:00 p.m. EST
                (GMT-5)/EDT(GMT-4), and are on call for
                emergencies during other hours.

Fax      +1 412-268-6989

Postal address
        CERT Coordination Center
        Software Engineering Institute
        Carnegie Mellon University
        Pittsburgh PA 15213-3890
        USA

CERT publications, information about FIRST representatives, and other
security-related information are available from
        http://www.cert.org/
        ftp://info.cert.org/pub/

CERT advisories and bulletins are also posted on the USENET newsgroup
        comp.security.announce

To be added to our mailing list for CERT advisories and bulletins, send your
email address to
        cert-advisory-request@cert.org
In the subject line, type
        SUBSCRIBE  your-email-address



* Registered U.S. Patent and Trademark Office.

The CERT Coordination Center is part of the Software Engineering
Institute (SEI). The SEI is sponsored by the U. S. Department of Defense.


This file: ftp://info.cert.org/pub/cert_bulletins/VB-97.05.lynx


Last revised July 17, 1997 - added acknowledgements

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM85qznVP+x0t4w7BAQEowQQA2251+mLRTDZ7IdAIgF+Nixsss+tKjvr/
4kRCBkUt5AW0eU5phu4ohjqN0EDbdXC6docAbRUZ00FAEbQrhl/Fy7yG+M+OWUja
Mb43gsg4VKkQqsqfWOjbIJAAcAJXlXKT7+ny4N0M9MAElMUwiWlszc+c+og5Ueqf
8Y2DZb6ABYc=
=U04F
-----END PGP SIGNATURE-----