PT-2010-3685 · W3M+3 · W3M+3
Publicado
2010-06-16
·
Atualizado
2024-06-15
·
CVE-2010-2074
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
w3m version 0.5.2
Description
The issue arises when
ssl verify server is enabled and the software fails to properly handle a '0' character in a domain name within the subject's Common Name or the Subject Alternative Name field of an X.509 certificate. This allows for man-in-the-middle attacks, where attackers can spoof arbitrary SSL servers using a crafted certificate issued by a legitimate Certification Authority.Recommendations
For w3m version 0.5.2, consider disabling the
ssl verify server option as a temporary workaround until a patch is available. Restrict access to SSL servers to minimize the risk of exploitation. Avoid using certificates with '0' characters in domain names until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Red Hat
Suse
W3M