Vulnerability Note VU#619812

UMN Gopher vulnerable to buffer overflow via overly long "+VIEWS:"

Overview

The University of Minnesota Gopher client may be vulnerable to a buffer overflow when handling overly long "+VIEWS:" reply messages sent from a malicious server.

I. Description

The UMN Gopher suite includes a Gopher client for navigating Gopherspace. However, the Gopher client may incorrectly handle a reply message from the server with overly long "+VIEWS:" content. The VIfromLine() function contains a boundary error when copying input to a buffer on the stack, which may cause a stack-based buffer overflow condition.

Successful exploitation may allow remote arbitrary code execution. If the user is running the gopher client with elevated privileges, the system may be compromised to the point of the attacking taking total control.

The Gopher protocol is generally disused at present and is disabled or not included in many popular web browsers and operating systems. However, the UMN Gopher code may be present in other clients, and as such may be exploitable by clicking on a seemingly-benign web link on a modern web browser.

II. Impact

A remote unauthenticated attacker may be able to execute arbitrary code on the remote system by convincing the user to follow a gopher link.

III. Solution

Disable Gopher support

Unless a specific need is known for Gopher support in your web browser or operating system, either disable support in the application or remove the Gopher application(s) from the system. This will help to mitigate future attacks should the Gopher code in question not be updated in a timely fashion.

Only connect to trusted hosts
As a best practice, do not connect to Gopher hosts or follow web links you are unfamiliar with. This may not mitigate the vulnerability exposure completely as it is not possible to be certain a server has not been compromised.

Apply an update
Contact your vendor for updates, fixes, and workarounds.

Systems Affected

Vendor	Status	Date Notified	Date Updated
UMN Gopher	Vulnerable	1-Sep-2005

References

http://secunia.com/advisories/16614/

Credit

Thanks to vade79 for reporting this vulnerability.

This document was written by Ken MacInnis.

Other Information

Date Public:	2005-08-30
Date First Published:	2005-09-02
Date Last Updated:	2005-09-02
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	1.27
Document Revision:	3

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader