Executive Summary

Summary
Title New elinks packages fix information disclosure
Informations
Name DSA-1380 First vendor Publication 2007-10-02
Vendor Debian Last vendor Modification 2007-10-02
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Kalle Olavi Niemitalo discovered that elinks, an advanced text-mode WWW browser, sent HTTP POST data in cleartext when using an HTTPS proxy server potentially allowing private information to be disclosed.

For the stable distribution (etch), this problem has been fixed in version 0.11.1-1.2etch1.

For the unstable distribution (sid), this problem has been fixed in version 0.11.1-1.5.

We recommend that you upgrade your elinks package.

Original Source

Url : http://www.debian.org/security/2007/dsa-1380

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-200 Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10335
 
Oval ID: oval:org.mitre.oval:def:10335
Title: ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.
Description: ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.
Family: unix Class: vulnerability
Reference(s): CVE-2007-5034
 Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17728
 
Oval ID: oval:org.mitre.oval:def:17728
Title: USN-519-1 -- elinks vulnerability
Description: Kalle Olavi Niemitalo discovered that if elinks makes a POST request to an HTTPS URL through a proxy, information may be sent in clear-text between elinks and the proxy.
Family: unix Class: patch
Reference(s): USN-519-1
CVE-2007-5034
 Version: 7
Platform(s): Ubuntu 6.06
Ubuntu 6.10
Ubuntu 7.04
 Product(s): elinks
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20456
 
Oval ID: oval:org.mitre.oval:def:20456
Title: DSA-1380-1 elinks - information disclosure
Description: Kalle Olavi Niemitalo discovered that elinks, an advanced text-mode WWW browser, sent HTTP POST data in cleartext when using an HTTPS proxy server potentially allowing private information to be disclosed.
Family: unix Class: patch
Reference(s): DSA-1380-1
CVE-2007-5034
 Version: 5
Platform(s): Debian GNU/Linux 4.0
 Product(s): elinks
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22290
 
Oval ID: oval:org.mitre.oval:def:22290
Title: ELSA-2007:0933: elinks security update (Moderate)
Description: ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.
Family: unix Class: patch
Reference(s): ELSA-2007:0933-02
CVE-2007-5034
 Version: 6
Platform(s): Oracle Linux 5
 Product(s): elinks
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 6

OpenVAS Exploits

Date Description
2009-03-23 Name : Ubuntu Update for elinks vulnerability USN-519-1
File : nvt/gb_ubuntu_USN_519_1.nasl
2009-02-27 Name : Fedora Update for elinks FEDORA-2007-2224
File : nvt/gb_fedora_2007_2224_elinks_fc7.nasl
2009-02-27 Name : Fedora Update for elinks FEDORA-2007-710
File : nvt/gb_fedora_2007_710_elinks_fc6.nasl
2008-01-17 Name : Debian Security Advisory DSA 1380-1 (elinks)
File : nvt/deb_1380_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
39291 ELinks https Proxy CONNECT Request Cleartext Information Disclosure

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2007-0933.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing a security update.
File : sl_20071004_elinks_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2007-11-10 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-519-1.nasl - Type : ACT_GATHER_INFO
2007-11-06 Name : The remote Fedora host is missing a security update.
File : fedora_2007-2224.nasl - Type : ACT_GATHER_INFO
2007-10-09 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2007-0933.nasl - Type : ACT_GATHER_INFO
2007-10-09 Name : The remote Fedora Core host is missing a security update.
File : fedora_2007-710.nasl - Type : ACT_GATHER_INFO
2007-10-09 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2007-0933.nasl - Type : ACT_GATHER_INFO
2007-10-03 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1380.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:26:54
  • Multiple Updates