5.1
CVSSv2

CVE-2012-4545

Published: 03/01/2013 Updated: 29/08/2017
CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9
VMScore: 454
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P

Vulnerability Summary

The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 prior to 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.

Vulnerable Product Search on Vulmon Subscribe to Product

elinks elinks 0.12

Vendor Advisories

Synopsis Moderate: elinks security update Type/Severity Security Advisory: Moderate Topic An updated elinks package that fixes one security issue is now availablefor Red Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common Vulnerab ...
Marko Myllynen discovered that ELinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate For the stable distribution (squeeze), this problem has been fixed in version 012~pre5-2+squeeze1 Since the initial Squeeze release, XULRunner needed to be updated and the version currently in the archive is incompatib ...