Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2007-5034 | First vendor Publication | 2007-09-21 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5034 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-200 | Information Exposure |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10335 | |||
| Oval ID: | oval:org.mitre.oval:def:10335 | ||
| Title: | ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https. | ||
| Description: | ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-5034 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17728 | |||
| Oval ID: | oval:org.mitre.oval:def:17728 | ||
| Title: | USN-519-1 -- elinks vulnerability | ||
| Description: | Kalle Olavi Niemitalo discovered that if elinks makes a POST request to an HTTPS URL through a proxy, information may be sent in clear-text between elinks and the proxy. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-519-1 CVE-2007-5034 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 | Product(s): | elinks |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:20456 | |||
| Oval ID: | oval:org.mitre.oval:def:20456 | ||
| Title: | DSA-1380-1 elinks - information disclosure | ||
| Description: | Kalle Olavi Niemitalo discovered that elinks, an advanced text-mode WWW browser, sent HTTP POST data in cleartext when using an HTTPS proxy server potentially allowing private information to be disclosed. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1380-1 CVE-2007-5034 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | elinks |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22290 | |||
| Oval ID: | oval:org.mitre.oval:def:22290 | ||
| Title: | ELSA-2007:0933: elinks security update (Moderate) | ||
| Description: | ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:0933-02 CVE-2007-5034 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | elinks |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 6 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-03-23 | Name : Ubuntu Update for elinks vulnerability USN-519-1 File : nvt/gb_ubuntu_USN_519_1.nasl |
| 2009-02-27 | Name : Fedora Update for elinks FEDORA-2007-2224 File : nvt/gb_fedora_2007_2224_elinks_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for elinks FEDORA-2007-710 File : nvt/gb_fedora_2007_710_elinks_fc6.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1380-1 (elinks) File : nvt/deb_1380_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 39291 | ELinks https Proxy CONNECT Request Cleartext Information Disclosure |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0933.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20071004_elinks_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-519-1.nasl - Type : ACT_GATHER_INFO |
| 2007-11-06 | Name : The remote Fedora host is missing a security update. File : fedora_2007-2224.nasl - Type : ACT_GATHER_INFO |
| 2007-10-09 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0933.nasl - Type : ACT_GATHER_INFO |
| 2007-10-09 | Name : The remote Fedora Core host is missing a security update. File : fedora_2007-710.nasl - Type : ACT_GATHER_INFO |
| 2007-10-09 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0933.nasl - Type : ACT_GATHER_INFO |
| 2007-10-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1380.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:16:14 |
|
| 2024-11-28 12:13:34 |
|
| 2021-05-05 01:04:02 |
|
| 2021-05-04 12:06:26 |
|
| 2021-04-22 01:06:58 |
|
| 2020-05-23 01:38:47 |
|
| 2020-05-23 00:20:30 |
|
| 2018-10-16 00:19:16 |
|
| 2017-09-29 09:23:13 |
|
| 2016-04-26 16:37:32 |
|
| 2014-02-17 10:41:52 |
|
| 2013-05-11 10:37:08 |
|
