PT-2013-1683 · Elinks+3 · Elinks+3

Marko Myllynen · Published 2013-01-03 · Updated 2022-12-30 · CVE-2012-4545

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ELinks versions prior to 0.12pre6

Description The issue concerns the delegation of user credentials through GSSAPI when using HTTP Negotiate or GSS-Negotiate authentication. This allows remote servers to authenticate as the client via the delegated credentials, potentially leading to unauthorized access.

Recommendations For versions prior to 0.12pre6, update to version 0.12pre6 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTP Negotiate or GSS-Negotiate authentication until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2019-2699

ALT-PU-2020-3033

ALT-PU-2022-3440

CESA-2013_0250

CVE-2012-4545

DSA-2592-1

RHSA-2013:0250

RHSA-2013_0250

Affected Products

Alt Linux

Centos

Elinks

Red Hat

References · 26

• https://linux.oracle.com/errata/ELSA-2013-0250.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0250.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4545 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-4545 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:075 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2699 · Vendor Advisory
• http://secunia.com/advisories/51569 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6709 · Security Note
• https://errata.altlinux.org/ALT-PU-2022-3440 · Vendor Advisory
• http://debian.org/security/2012/dsa-2592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4545 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4545 · Security Note
• https://errata.altlinux.org/ALT-PU-2020-3033 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-4545 · Vendor Advisory
• http://securityfocus.com/bid/57065 · Note