CVE-2012-6709
First published: Wed Nov 28 2012(Updated: )
A Debian bug report [1] indicated that Links does not properly verify SSL certificates. If you visit a web site with an expired SSL certificate, Links will only display "SSL error" without any indication as to what the error was. This, in and of itself, is not a flaw however when testing, I found that when you go to a site with a valid SSL certificate, but for a different hostname (for example, if you go to <a href="https://alias.foo.com">https://alias.foo.com</a> which might be a CNAME or a proxy for <a href="https://foo.com">https://foo.com</a>) Links will connect without any errors or warnings. Doing the same in a browser like Google Chrome, however, reports "You attempted to reach alias.foo.com, but instead you actually reached a server identifying itself as foo.com." and allows you to either proceed or not, before loading the site. [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Elinks Elinks | =0.12 | |
| Twibright Links | =2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658
- https://bugzilla.redhat.com/show_bug.cgi?id=881399
- https://alias.foo.com
- https://foo.com
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=881411
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=881409
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=881410
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740981
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=881411#c22
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1099423
- http://pkgs.fedoraproject.org/cgit/elinks.git/tree/elinks-0.12pre6-ssl-hostname.patch?id=6e8e7242
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1035386&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1035386&action=edit
- http://repo.or.cz/w/elinks.git
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1037270&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1037270&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=881399#c23
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=881399#c24
- http://lists.linuxfromscratch.org/pipermail/elinks-dev/2015-June/002099.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=881399#c25
- http://pkgs.fedoraproject.org/cgit/elinks.git/commit/?id=f94b7750
- https://access.redhat.com/security/updates/classification/
- collector/nvd-index
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-6709
- vendor/elinks
- canonical/elinks elinks
- version/elinks elinks/0.12
- vendor/twibright
- canonical/twibright links
- version/twibright links/2.3