ELinks SSL Certificate Host Name Validation Security Bypass Vulnerability

Bugtraq ID:	65092
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 21 2014 12:00AM
Updated:	Jan 21 2014 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Mandriva Business Server 1 X86 64 Mandriva Business Server 1 ELinks ELinks 0.12 Pre5
Not Vulnerable:	ELinks ELinks 0.12pre6

ELinks SSL Certificate Host Name Validation Security Bypass Vulnerability

ELinks is prone to a security-bypass vulnerability because it fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Versions prior to ELinks 0.12-pre6 are vulnerable.

ELinks SSL Certificate Host Name Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

ELinks SSL Certificate Host Name Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva elinks-0.12-2.2.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

ELinks SSL Certificate Host Name Validation Security Bypass Vulnerability

References:

• Elinks Home Page (Elinks)