[Forgot Password]
Login  Register Subscribe

23631

 
 

117687

 
 

98503

 
 

909

 
 

79281

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2012-4545

Date: (C)2013-01-07   (M)2017-11-18 


The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.

CVSS Score: 5.1Access Vector: NETWORK
Exploit Score: 4.9Access Complexity: HIGH
Impact Score: 6.4Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: PARTIAL
 Availability: PARTIAL





Reference:
SECUNIA-51569
BID-57065
DSA-2592
MDVSA-2013:075
RHSA-2013:0250
elinks-httpnegotiate-security-bypass(80882)
http://bugzilla.elinks.cz/show_bug.cgi?id=1124
http://repo.or.cz/w/elinks.git/blobdiff/89056e21fc7ab8e1c2d4e06ec9d0c6d01e70669a..da18694ff7dd0b67dfcb3c417fb0579b1e7d02d7:/src/protocol/http/http_negotiate.c

CPE    5
cpe:/a:elinks:elinks:0.12:pre1
cpe:/a:elinks:elinks:0.12:pre4
cpe:/a:elinks:elinks:0.12:pre5
cpe:/a:elinks:elinks:0.12:pre2
...
CWE    1
CWE-287
OVAL    9
oval:org.secpod.oval:def:202551
oval:org.secpod.oval:def:202550
oval:org.secpod.oval:def:1500041
oval:org.secpod.oval:def:106018
...

© 2013 SecPod Technologies