{"vuid":"VU#619812","idnumber":"619812","name":"UMN Gopher vulnerable to buffer overflow via overly long \"+VIEWS:\"","keywords":["UMN","Gopher","buffer overflow","VIfromLine()","stack-based","+VIEWS:"],"overview":"The University of Minnesota Gopher client may be vulnerable to a buffer overflow when handling overly long \"+VIEWS:\" reply messages sent from a malicious server.","clean_desc":"The UMN Gopher suite includes a Gopher client for navigating Gopherspace. However, the Gopher client may incorrectly handle a reply message from the server with overly long \"+VIEWS:\" content. The VIfromLine() function contains a boundary error when copying input to a buffer on the stack, which may cause a stack-based buffer overflow condition. Successful exploitation may allow remote arbitrary code execution. If the user is running the gopher client with elevated privileges, the system may be compromised to the point of the attacking taking total control. The Gopher protocol is generally disused at present and is disabled or not included in many popular web browsers and operating systems. However, the UMN Gopher code may be present in other clients, and as such may be exploitable by clicking on a seemingly-benign web link on a modern web browser.","impact":"A remote unauthenticated attacker may be able to execute arbitrary code on the remote system by convincing the user to follow a gopher link.","resolution":"Disable Gopher support\nUnless a specific need is known for Gopher support in your web browser or operating system, either disable support in the application or remove the Gopher application(s) from the system. This will help to mitigate future attacks should the Gopher code in question not be updated in a timely fashion. Only connect to trusted hosts\nAs a best practice, do not connect to Gopher hosts or follow web links you are unfamiliar with. This may not mitigate the vulnerability exposure completely as it is not possible to be certain a server has not been compromised. Apply an update\nContact your vendor for updates, fixes, and workarounds.","workarounds":"","sysaffected":"","thanks":"Thanks to vade79 for reporting this vulnerability.","author":"This document was written by Ken MacInnis.","public":["h","t","t","p",":","/","/","s","e","c","u","n","i","a",".","c","o","m","/","a","d","v","i","s","o","r","i","e","s","/","1","6","6","1","4","/"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2005-08-30T14:49:26Z","publicdate":"2005-08-30T00:00:00Z","datefirstpublished":"2005-09-02T16:27:24Z","dateupdated":"2005-09-02T16:27:34Z","revision":7,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"20","cam_exploitation":"0","cam_internetinfrastructure":"5","cam_population":"1","cam_impact":"18","cam_easeofexploitation":"10","cam_attackeraccessrequired":"15","cam_scorecurrent":"1.265625","cam_scorecurrentwidelyknown":"1.265625","cam_scorecurrentwidelyknownexploited":"2.278125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":1.265625,"vulnote":null}