[Forgot Password]
Login  Register Subscribe

24128

 
 

131573

 
 

111017

 
 

909

 
 

86402

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2012-4545Date: (C)2013-01-07   (M)2018-05-10


The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V3 Severity:CVSS V2 Severity:
CVSS Score : CVSS Score : 5.1
Exploit Score: Exploit Score: 4.9
Impact Score: Impact Score: 6.4
 
CVSS V3 Metrics:CVSS V2 Metrics:
Attack Vector: Access Vector: NETWORK
Attack Complexity: Access Complexity: HIGH
Privileges Required: Authentication: NONE
User Interaction: Confidentiality: PARTIAL
Scope: Integrity: PARTIAL
Confidentiality: Availability: PARTIAL
Integrity:  
Availability:  
  
Reference:
SECUNIA-51569
BID-57065
DSA-2592
MDVSA-2013:075
RHSA-2013:0250
elinks-httpnegotiate-security-bypass(80882)
http://bugzilla.elinks.cz/show_bug.cgi?id=1124
http://repo.or.cz/w/elinks.git/blobdiff/89056e21fc7ab8e1c2d4e06ec9d0c6d01e70669a..da18694ff7dd0b67dfcb3c417fb0579b1e7d02d7:/src/protocol/http/http_negotiate.c

CPE    5
cpe:/a:elinks:elinks:0.12:pre1
cpe:/a:elinks:elinks:0.12:pre4
cpe:/a:elinks:elinks:0.12:pre5
cpe:/a:elinks:elinks:0.12:pre2
...
CWE    1
CWE-287
OVAL    9
oval:org.secpod.oval:def:600936
oval:org.secpod.oval:def:500967
oval:org.secpod.oval:def:104431
oval:org.secpod.oval:def:104441
...

© SecPod Technologies