Software Engineering Institute

The UMN Gopher suite includes a Gopher client for navigating Gopherspace. However, the Gopher client may incorrectly handle a reply message from the server with overly long "+VIEWS:" content. The VIfromLine() function contains a boundary error when copying input to a buffer on the stack, which may cause a stack-based buffer overflow condition.

Successful exploitation may allow remote arbitrary code execution. If the user is running the gopher client with elevated privileges, the system may be compromised to the point of the attacking taking total control.

The Gopher protocol is generally disused at present and is disabled or not included in many popular web browsers and operating systems. However, the UMN Gopher code may be present in other clients, and as such may be exploitable by clicking on a seemingly-benign web link on a modern web browser.

A remote unauthenticated attacker may be able to execute arbitrary code on the remote system by convincing the user to follow a gopher link.

Disable Gopher support
Unless a specific need is known for Gopher support in your web browser or operating system, either disable support in the application or remove the Gopher application(s) from the system. This will help to mitigate future attacks should the Gopher code in question not be updated in a timely fashion.

Only connect to trusted hosts
As a best practice, do not connect to Gopher hosts or follow web links you are unfamiliar with. This may not mitigate the vulnerability exposure completely as it is not possible to be certain a server has not been compromised.

Apply an update
Contact your vendor for updates, fixes, and workarounds.