W3M NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	40837
Class:	Design Error
CVE:	CVE-2010-2074
Remote:	Yes
Local:	No
Published:	Jun 14 2010 12:00AM
Updated:	Apr 13 2015 09:53PM
Credit:	Ludwig Nussel
Vulnerable:	W3M W3M 0.5.2 W3M W3M 0.5.1 W3M W3M 0.3.2 .2 W3M W3M 0.3.2 .1 W3M W3M 0.3.2 W3M W3M 0.3.1 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 W3M W3M 0.3 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 W3M W3M 0.2.5 .1 W3M W3M 0.2.5 W3M W3M 0.2.4 W3M W3M 0.2.3 W3M W3M 0.2.2 W3M W3M 0.2.1 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 W3M W3M 0.2 + Redhat Linux 7.0 i386 + Redhat Linux 7.0 W3M W3M 0.1.10 W3M W3M 0.1.9 W3M W3M 0.1.8 W3M W3M 0.1.7 W3M W3M 0.1.6 W3M W3M 0.1.4 W3M W3M 0.1.3 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 amd64 SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SP3 Sun Solaris 11 Express snv_151a Sun Solaris 11 Express S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Gentoo Linux
Not Vulnerable:

W3M NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

W3M is prone to a security-bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

W3M NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Attackers use man-in-the-middle attacks to exploit this issue.

W3M NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu w3m-img_0.5.2-2ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.2-2ubuntu1.1_s parc.deb


• Ubuntu w3m_0.5.2-2ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.2-2ubuntu1.1_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu w3m-img_0.5.1-5.1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.1-5.1ubuntu1.1 _powerpc.deb


• Ubuntu w3m_0.5.1-5.1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.1-5.1ubuntu1.1_powerpc .deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu w3m-img_0.5.1-5.1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.1-5.1ubuntu1.1 _sparc.deb


• Ubuntu w3m_0.5.1-5.1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.1-5.1ubuntu1.1_sparc.d eb

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu w3m-img_0.5.2-2ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.2-2ubuntu1.1_p owerpc.deb


• Ubuntu w3m_0.5.2-2ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.2-2ubuntu1.1_powerpc.d eb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu w3m-img_0.5.1-4ubuntu2.6.06.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4u buntu2.6.06.1_sparc.deb


• Ubuntu w3m_0.5.1-4ubuntu2.6.06.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6 .06.1_sparc.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu w3m-img_0.5.1-4ubuntu2.6.06.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4u buntu2.6.06.1_powerpc.deb


• Ubuntu w3m_0.5.1-4ubuntu2.6.06.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6 .06.1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu w3m-img_0.5.1-5.1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-5. 1ubuntu1.1_amd64.deb


• Ubuntu w3m_0.5.1-5.1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-5.1ubuntu1 .1_amd64.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu w3m-img_0.5.2-2ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.2-2ubuntu1.1_l pia.deb


• Ubuntu w3m_0.5.2-2ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.2-2ubuntu1.1_lpia.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu w3m-img_0.5.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.2-2ubuntu0.1_s parc.deb


• Ubuntu w3m_0.5.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.2-2ubuntu0.1_sparc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu w3m-img_0.5.1-5.1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.1-5.1ubuntu1.1 _lpia.deb


• Ubuntu w3m_0.5.1-5.1ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.1-5.1ubuntu1.1_lpia.de b

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu w3m-img_0.5.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.2-2ubuntu0.1_p owerpc.deb


• Ubuntu w3m_0.5.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.2-2ubuntu0.1_powerpc.d eb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu w3m-img_0.5.1-4ubuntu2.6.06.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4u buntu2.6.06.1_i386.deb


• Ubuntu w3m_0.5.1-4ubuntu2.6.06.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6 .06.1_i386.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu w3m-img_0.5.1-4ubuntu2.6.06.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-4u buntu2.6.06.1_amd64.deb


• Ubuntu w3m_0.5.1-4ubuntu2.6.06.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-4ubuntu2.6 .06.1_amd64.deb

Ubuntu Ubuntu Linux 10.04 powerpc

• Ubuntu w3m-img_0.5.2-2.1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.2-2.1ubuntu1.1 _powerpc.deb


• Ubuntu w3m_0.5.2-2.1ubuntu1.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.2-2.1ubuntu1.1_powerpc .deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu w3m-img_0.5.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.2-2u buntu0.1_i386.deb


• Ubuntu w3m_0.5.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.2-2ubuntu0.1 _i386.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu w3m-img_0.5.2-2ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.2-2ubuntu0.1_l pia.deb


• Ubuntu w3m_0.5.2-2ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.2-2ubuntu0.1_lpia.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu w3m-img_0.5.2-2ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.2-2u buntu1.1_i386.deb


• Ubuntu w3m_0.5.2-2ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.2-2ubuntu1.1 _i386.deb

Ubuntu Ubuntu Linux 10.04 amd64

• Ubuntu w3m-img_0.5.2-2.1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.2-2. 1ubuntu1.1_amd64.deb


• Ubuntu w3m_0.5.2-2.1ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.2-2.1ubuntu1 .1_amd64.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu w3m-img_0.5.2-2ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.2-2u buntu1.1_amd64.deb


• Ubuntu w3m_0.5.2-2ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.2-2ubuntu1.1 _amd64.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu w3m-img_0.5.1-5.1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.1-5. 1ubuntu1.1_i386.deb


• Ubuntu w3m_0.5.1-5.1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.1-5.1ubuntu1 .1_i386.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu w3m-img_0.5.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.2-2u buntu0.1_amd64.deb


• Ubuntu w3m_0.5.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.2-2ubuntu0.1 _amd64.deb

Ubuntu Ubuntu Linux 10.04 sparc

• Ubuntu w3m-img_0.5.2-2.1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/universe/w/w3m/w3m-img_0.5.2-2.1ubuntu1.1 _sparc.deb


• Ubuntu w3m_0.5.2-2.1ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/w/w3m/w3m_0.5.2-2.1ubuntu1.1_sparc.d eb

Ubuntu Ubuntu Linux 10.04 i386

• Ubuntu w3m-img_0.5.2-2.1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/universe/w/w3m/w3m-img_0.5.2-2. 1ubuntu1.1_i386.deb


• Ubuntu w3m_0.5.2-2.1ubuntu1.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/w/w3m/w3m_0.5.2-2.1ubuntu1 .1_i386.deb

W3M NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

References:

• CVE Request: w3m does not check null bytes CN/subjAltName (Ludwig Nussel)
  
• CVE-2010-2074 Improper Input Validation Vulnerability in w3m (Oracle)
  
• Null Prefix Attacks Against SSL/TLS Certificates (Moxie Marlinspike)
  
• W3M Homepage (W3M)