CVE-2012-6709: Medium severity ELinks Elinks vulnerability
A Debian bug report [1] indicated that Links does not properly verify SSL certificates. If you visit a web site with an expired SSL certificate, Links will only display "SSL error" without any indication as to what the error was. This, in and of itself, is not a flaw however when testing, I found that when you go to a site with a valid SSL certificate, but for a different hostname (for example, if you go to https://alias.foo.com which might be a CNAME or a proxy for https://foo.com) Links will connect without any errors or warnings. Doing the same in a browser like Google Chrome, however, reports "You attempted to reach alias.foo.com, but instead you actually reached a server identifying itself as foo.com." and allows you to either proceed or not, before loading the site.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=694658
Other sources
ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6709?
CVE-2012-6709 has a moderate severity level due to improper SSL certificate verification.
How does CVE-2012-6709 affect users?
CVE-2012-6709 can lead users to unknowingly accept expired SSL certificates without proper warnings.
Which software versions are affected by CVE-2012-6709?
CVE-2012-6709 affects Links versions 2.3 and ELinks version 0.12.
Are there any known exploits for CVE-2012-6709?
As of now, there are no known public exploits specifically targeting CVE-2012-6709.
How can I mitigate the risks of CVE-2012-6709?
To mitigate CVE-2012-6709, users should upgrade to a version of Links or ELinks that addresses SSL verification issues.